Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/ai/usage.ts

@@ -4,7 +4,9 @@ import { usage_events, profiles } from "@/lib/db/schema"
 import { PLAN_LIMITS } from "@/lib/stripe/plans"
 import type { Plan } from "@/types"
 
-type QuotaResult = { ok: true } | { ok: false; status: number; error: string }
+type QuotaResult =
+  | { ok: true; used: number; limit: number }
+  | { ok: false; status: number; error: string }
 
 // Sentinel for "effectively unlimited" plans. PLAN_LIMITS uses Infinity for
 // some limits; treat Infinity (or anything absurdly large) as uncapped so we
@@ -42,7 +44,11 @@ export async function enforceAiQuota(
   // Unlimited plans: skip counting, but still record the event for analytics.
   if (!Number.isFinite(limit) || limit >= UNLIMITED_THRESHOLD) {
     await db.insert(usage_events).values({ user_id: userId, event_type: eventType })
-    return { ok: true }
+    const [{ count }] = await db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(usage_events)
+      .where(and(eq(usage_events.user_id, userId), gte(usage_events.created_at, monthStart.toISOString())))
+    return { ok: true, used: count, limit }
   }
 
   // Sentinel thrown from inside the transaction to signal an over-limit
@@ -74,7 +80,7 @@ export async function enforceAiQuota(
 
       await tx.insert(usage_events).values({ user_id: userId, event_type: eventType })
 
-      return { ok: true } as QuotaResult
+      return { ok: true, used: count + 1, limit } as QuotaResult
     })
   } catch (err) {
     if (err === overLimit) return overLimit