feat(admin): per-port email/Documenso/branding/reminder settings + invitations

Centralizes everything operators need to configure into the admin panel,
each setting per-port with env fallback.

New admin pages
- /admin              landing page linking to every admin section as a card
- /admin/email        FROM name+address, reply-to, signature/footer HTML,
                      optional SMTP host/port/user/pass override
- /admin/documenso    API URL+key override, EOI Documenso template ID,
                      default EOI pathway (documenso-template vs inapp),
                      "Test connection" button
- /admin/branding     logo URL, primary color, app name, email
                      header/footer HTML
- /admin/reminders    port-level defaults for new interests +
                      port-wide daily-digest delivery window
- /admin/invitations  send / list / resend / revoke CRM invitations

Per-user reminder digest
- /notifications/preferences gains a Reminder digest card:
  immediate / daily / weekly / off, with HH:MM, day-of-week,
  IANA timezone fields. Stored in user_profiles.preferences.reminders.

Plumbing
- port-config.ts typed accessors (getPortEmailConfig, getPortDocumensoConfig,
  getPortBrandingConfig, getPortReminderConfig) — settings → env fallback.
- sendEmail accepts optional portId; resolves From/SMTP from settings
  when supplied.
- documensoFetch + downloadSignedPdf accept optional portId; each public
  function takes it through. checkDocumensoHealth() backs the test button.
- crm-invite.service gains listCrmInvites / revokeCrmInvite / resendCrmInvite
  with audit-log entries (revoke_invite, resend_invite added to AuditAction).
- AdminLandingPage card grid + shared SettingsFormCard component to remove
  per-page form boilerplate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/documenso-client.ts

@@ -1,14 +1,28 @@
 import { env } from '@/lib/env';
 import { logger } from '@/lib/logger';
+import { getPortDocumensoConfig } from '@/lib/services/port-config';
 
-const BASE_URL = env.DOCUMENSO_API_URL;
-const API_KEY = env.DOCUMENSO_API_KEY;
+interface DocumensoCreds {
+  baseUrl: string;
+  apiKey: string;
+}
 
-async function documensoFetch(path: string, options?: RequestInit): Promise<unknown> {
-  const res = await fetch(`${BASE_URL}${path}`, {
+async function resolveCreds(portId?: string): Promise<DocumensoCreds> {
+  if (!portId) return { baseUrl: env.DOCUMENSO_API_URL, apiKey: env.DOCUMENSO_API_KEY };
+  const cfg = await getPortDocumensoConfig(portId);
+  return { baseUrl: cfg.apiUrl, apiKey: cfg.apiKey };
+}
+
+async function documensoFetch(
+  path: string,
+  options?: RequestInit,
+  portId?: string,
+): Promise<unknown> {
+  const { baseUrl, apiKey } = await resolveCreds(portId);
+  const res = await fetch(`${baseUrl}${path}`, {
     ...options,
     headers: {
-      Authorization: `Bearer ${API_KEY}`,
+      Authorization: `Bearer ${apiKey}`,
       'Content-Type': 'application/json',
       ...options?.headers,
     },
@@ -16,7 +30,7 @@ async function documensoFetch(path: string, options?: RequestInit): Promise<unkn
 
   if (!res.ok) {
     const err = await res.text();
-    logger.error({ path, status: res.status, err }, 'Documenso API error');
+    logger.error({ path, status: res.status, err, portId }, 'Documenso API error');
     throw new Error(`Documenso API error: ${res.status}`);
   }
 
@@ -70,50 +84,88 @@ export async function createDocument(
   title: string,
   pdfBase64: string,
   recipients: DocumensoRecipient[],
+  portId?: string,
 ): Promise<DocumensoDocument> {
-  return documensoFetch('/api/v1/documents', {
-    method: 'POST',
-    body: JSON.stringify({ title, document: pdfBase64, recipients }),
-  }).then(normalizeDocument);
+  return documensoFetch(
+    '/api/v1/documents',
+    {
+      method: 'POST',
+      body: JSON.stringify({ title, document: pdfBase64, recipients }),
+    },
+    portId,
+  ).then(normalizeDocument);
 }
 
 export async function generateDocumentFromTemplate(
   templateId: number,
   payload: Record<string, unknown>,
+  portId?: string,
 ): Promise<DocumensoDocument> {
-  return documensoFetch(`/api/v1/templates/${templateId}/generate-document`, {
-    method: 'POST',
-    body: JSON.stringify(payload),
-  }).then(normalizeDocument);
+  return documensoFetch(
+    `/api/v1/templates/${templateId}/generate-document`,
+    {
+      method: 'POST',
+      body: JSON.stringify(payload),
+    },
+    portId,
+  ).then(normalizeDocument);
 }
 
-export async function sendDocument(docId: string): Promise<DocumensoDocument> {
-  return documensoFetch(`/api/v1/documents/${docId}/send`, {
-    method: 'POST',
-  }).then(normalizeDocument);
+export async function sendDocument(docId: string, portId?: string): Promise<DocumensoDocument> {
+  return documensoFetch(
+    `/api/v1/documents/${docId}/send`,
+    {
+      method: 'POST',
+    },
+    portId,
+  ).then(normalizeDocument);
 }
 
-export async function getDocument(docId: string): Promise<DocumensoDocument> {
-  return documensoFetch(`/api/v1/documents/${docId}`).then(normalizeDocument);
+export async function getDocument(docId: string, portId?: string): Promise<DocumensoDocument> {
+  return documensoFetch(`/api/v1/documents/${docId}`, undefined, portId).then(normalizeDocument);
 }
 
-export async function sendReminder(docId: string, signerId: string): Promise<void> {
-  await documensoFetch(`/api/v1/documents/${docId}/recipients/${signerId}/remind`, {
-    method: 'POST',
-  });
+export async function sendReminder(
+  docId: string,
+  signerId: string,
+  portId?: string,
+): Promise<void> {
+  await documensoFetch(
+    `/api/v1/documents/${docId}/recipients/${signerId}/remind`,
+    {
+      method: 'POST',
+    },
+    portId,
+  );
 }
 
-export async function downloadSignedPdf(docId: string): Promise<Buffer> {
-  const res = await fetch(`${BASE_URL}/api/v1/documents/${docId}/download`, {
-    headers: { Authorization: `Bearer ${API_KEY}` },
+export async function downloadSignedPdf(docId: string, portId?: string): Promise<Buffer> {
+  const { baseUrl, apiKey } = await resolveCreds(portId);
+  const res = await fetch(`${baseUrl}/api/v1/documents/${docId}/download`, {
+    headers: { Authorization: `Bearer ${apiKey}` },
   });
 
   if (!res.ok) {
     const err = await res.text();
-    logger.error({ docId, status: res.status, err }, 'Documenso download error');
+    logger.error({ docId, status: res.status, err, portId }, 'Documenso download error');
     throw new Error(`Documenso download error: ${res.status}`);
   }
 
   const arrayBuffer = await res.arrayBuffer();
   return Buffer.from(arrayBuffer);
 }
+
+/** Convenience health-check used by the admin "Test connection" button. */
+export async function checkDocumensoHealth(
+  portId?: string,
+): Promise<{ ok: boolean; status?: number; error?: string }> {
+  try {
+    const { baseUrl, apiKey } = await resolveCreds(portId);
+    const res = await fetch(`${baseUrl}/api/v1/health`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+    });
+    return { ok: res.ok, status: res.status };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : 'Unknown error' };
+  }
+}