Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/settings.ts

@@ -0,0 +1,46 @@
+import { eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { app_settings } from "@/lib/db/schema"
+
+const MAINTENANCE_KEY = "maintenance_mode"
+
+export type MaintenanceState = {
+  enabled: boolean
+  message: string | null
+}
+
+const DEFAULT_MAINTENANCE: MaintenanceState = { enabled: false, message: null }
+
+/**
+ * Reads the site maintenance-mode flag from app_settings.
+ *
+ * Fails OPEN: any DB/read error returns "disabled" so a database hiccup can
+ * never accidentally lock the entire site (including admins) out. This is
+ * called from the marketing + dashboard layouts on navigation.
+ */
+export async function getMaintenanceMode(): Promise<MaintenanceState> {
+  try {
+    const row = await db.query.app_settings.findFirst({
+      where: eq(app_settings.key, MAINTENANCE_KEY),
+    })
+    if (!row) return DEFAULT_MAINTENANCE
+    const v = row.value as Partial<MaintenanceState> | null
+    return {
+      enabled: Boolean(v?.enabled),
+      message: typeof v?.message === "string" && v.message.trim() ? v.message : null,
+    }
+  } catch {
+    return DEFAULT_MAINTENANCE
+  }
+}
+
+/** Upserts the site maintenance-mode flag. Admin-gated by the calling action. */
+export async function setMaintenanceMode(state: MaintenanceState): Promise<void> {
+  await db
+    .insert(app_settings)
+    .values({ key: MAINTENANCE_KEY, value: state })
+    .onConflictDoUpdate({
+      target: app_settings.key,
+      set: { value: state, updated_at: new Date().toISOString() },
+    })
+}