Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/email/client.ts

@@ -1,9 +1,33 @@
-import { Resend } from "resend"
+import nodemailer, { type Transporter } from "nodemailer"
 
-// Use a placeholder when no key is configured so the constructor doesn't throw
-// at module load (it's imported on the auth path). Sends will fail gracefully
-// and are caught in sendEmail().
-export const resend = new Resend(process.env.RESEND_API_KEY || "re_placeholder")
+// SMTP transport (SMTP2GO). Created lazily so importing this on the auth path
+// doesn't require SMTP to be configured. Sends fail gracefully in sendEmail().
+const SMTP_HOST = process.env.SMTP_HOST
+const SMTP_PORT = Number(process.env.SMTP_PORT ?? 587)
+const SMTP_USER = process.env.SMTP_USER
+const SMTP_PASS = process.env.SMTP_PASS
 
-export const FROM_EMAIL = process.env.RESEND_FROM_EMAIL ?? "noreply@propertymanagement.network"
+export const FROM_EMAIL =
+  process.env.EMAIL_FROM ??
+  process.env.SMTP_FROM ??
+  "postmaster@propertymanagement.network"
 export const APP_NAME = process.env.NEXT_PUBLIC_APP_NAME ?? "Property Management Network"
+
+/** True when SMTP is configured (host + credentials present). */
+export function emailConfigured(): boolean {
+  return Boolean(SMTP_HOST && SMTP_USER && SMTP_PASS)
+}
+
+let _transporter: Transporter | null = null
+export function getTransporter(): Transporter {
+  if (!_transporter) {
+    _transporter = nodemailer.createTransport({
+      host: SMTP_HOST,
+      port: SMTP_PORT,
+      // Port 465 uses implicit TLS/SSL; 587/2525/etc. negotiate STARTTLS.
+      secure: SMTP_PORT === 465,
+      auth: SMTP_USER && SMTP_PASS ? { user: SMTP_USER, pass: SMTP_PASS } : undefined,
+    })
+  }
+  return _transporter
+}