Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/legal.ts

@@ -0,0 +1,89 @@
+// ============================================================================
+// Central legal configuration — single source of truth for every legal page.
+//
+// ⚠️ REVIEW BEFORE LAUNCH: `entity`, `address`, `governingLaw`, and `forum`
+// are placeholders. Set them to your real registered company, business address,
+// and chosen governing-law jurisdiction, and have qualified legal counsel review
+// all policy copy for your specific business and markets. These templates are a
+// strong, comprehensive starting point — not a substitute for legal advice.
+// ============================================================================
+
+export const LEGAL = {
+  /** Product / service name shown to users. */
+  service: "Property Management Network",
+  /** Legal entity that operates the Service. Update to your registered company. */
+  entity: "Property Management Network",
+  /** Registered business address (shown on legal pages). */
+  address: "[Registered business address]",
+
+  // Contacts
+  contactEmail: "support@propertymanagement.network",
+  privacyEmail: "privacy@propertymanagement.network",
+  legalEmail: "legal@propertymanagement.network",
+  dpoEmail: "dpo@propertymanagement.network",
+  securityEmail: "security@propertymanagement.network",
+
+  // Dispute resolution — update to your actual jurisdiction.
+  governingLaw: "the State of Delaware, United States",
+  forum: "the state and federal courts located in Delaware, United States",
+
+  // Dates (update `lastUpdated` whenever a policy changes).
+  effectiveDate: "July 1, 2026",
+  lastUpdated: "July 1, 2026",
+
+  // Refund window for the Lifetime one-time plan.
+  lifetimeRefundDays: 14,
+  // How long personal data is retained after account deletion (days).
+  dataDeletionDays: 30,
+} as const
+
+/**
+ * Third parties that process personal data on our behalf. This list is the
+ * authoritative sub-processor register referenced by the DPA and GDPR pages.
+ * Keep it accurate — it reflects the actual production stack.
+ */
+export const SUBPROCESSORS = [
+  {
+    name: "DigitalOcean, LLC",
+    purpose: "Cloud hosting (App Platform), Managed PostgreSQL database, and Spaces object storage for uploaded files",
+    location: "United States / EU (data-center region dependent)",
+  },
+  {
+    name: "Stripe, Inc.",
+    purpose: "Payment processing and subscription billing (card data is handled by Stripe; we never store it)",
+    location: "United States (Standard Contractual Clauses)",
+  },
+  {
+    name: "SMTP2GO (SMTP2GO Ltd.)",
+    purpose: "Transactional and notification email delivery (SMTP)",
+    location: "United States / New Zealand (Standard Contractual Clauses)",
+  },
+  {
+    name: "OpenAI, L.L.C.",
+    purpose: "AI-generated insights; portfolio data is sent per request and is not used to train models",
+    location: "United States (Standard Contractual Clauses)",
+  },
+  {
+    name: "Cloudflare, Inc.",
+    purpose: "Bot-protection challenge (Turnstile) on authentication forms",
+    location: "Global edge network",
+  },
+  {
+    name: "Google LLC",
+    purpose: "Optional Google sign-in (OAuth) when a user chooses it",
+    location: "United States (Standard Contractual Clauses)",
+  },
+] as const
+
+/** All legal pages, in the order shown in the footer and cross-link nav. */
+export const LEGAL_PAGES = [
+  { href: "/terms", label: "Terms of Service" },
+  { href: "/privacy", label: "Privacy Policy" },
+  { href: "/cookie-policy", label: "Cookie Policy" },
+  { href: "/acceptable-use", label: "Acceptable Use Policy" },
+  { href: "/refund-policy", label: "Refund & Cancellation" },
+  { href: "/dpa", label: "Data Processing Addendum" },
+  { href: "/subprocessors", label: "Sub-processors" },
+  { href: "/gdpr", label: "GDPR & Data Rights" },
+  { href: "/disclaimer", label: "Disclaimer" },
+] as const