Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/paypal/fulfill.ts

@@ -0,0 +1,53 @@
+import { eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { profiles } from "@/lib/db/schema"
+import type { Plan } from "@/types"
+
+// Applies PayPal subscription/order outcomes to a profile. Shared by the return
+// handler (synchronous, on approval redirect) and the webhook (async, for
+// renewals/cancellations). Both are idempotent.
+
+const RECURRING: ReadonlyArray<Plan> = ["pro", "landlord"]
+
+export async function fulfillSubscription(
+  userId: string,
+  plan: string,
+  subscriptionId: string,
+  nextBillingTime?: string | null,
+  status = "active",
+): Promise<void> {
+  if (!RECURRING.includes(plan as Plan)) return
+  await db
+    .update(profiles)
+    .set({
+      plan: plan as Plan,
+      subscription_status: status,
+      paypal_subscription_id: subscriptionId,
+      billing_provider: "paypal",
+      plan_expires_at: nextBillingTime ?? null,
+    })
+    .where(eq(profiles.id, userId))
+}
+
+export async function fulfillLifetime(userId: string): Promise<void> {
+  await db
+    .update(profiles)
+    .set({ plan: "lifetime", subscription_status: "active", billing_provider: "paypal" })
+    .where(eq(profiles.id, userId))
+}
+
+/** Downgrade/mark a profile by its PayPal subscription id (cancel/expire/suspend). */
+export async function markPaypalSubscriptionInactive(
+  subscriptionId: string,
+  status: string,
+  downgrade: boolean,
+): Promise<void> {
+  await db
+    .update(profiles)
+    .set(
+      downgrade
+        ? { subscription_status: status, plan: "starter", paypal_subscription_id: null, plan_expires_at: null }
+        : { subscription_status: status },
+    )
+    .where(eq(profiles.paypal_subscription_id, subscriptionId))
+}