Harden deploy gates, prod AUTH_SECRET, and Sentry error reporting.

Align onlyBuiltDependencies with the workspace, fail fast without AUTH_SECRET in production, and delete catalog_items via VARCHAR-safe SQL so page deletes do not leave orphans.

Co-authored-by: Cursor <[email protected]>

.env.example

@@ -14,7 +14,8 @@ APP_URL=http://localhost:3000
 # NEXT_PUBLIC_APP_URL=https://yourdomain.com
 AUTH_URL=http://localhost:3000
 
-# NextAuth (>=32 chars) + Laravel APP_KEY (base64:...) for existing 2FA secrets
+# NextAuth — required in production (>=32 chars). Optional in development.
+# Laravel APP_KEY (base64:...) for existing 2FA secrets.
 AUTH_SECRET=
 APP_KEY=
 CONVERT_PASSWORDS=false
@@ -88,4 +89,6 @@ SENTRY_ORG=
 SENTRY_PROJECT=
 SENTRY_AUTH_TOKEN=
 # Optional release tag shown in Sentry (e.g. git sha).
+# Deploy sets APP_VERSION + NEXT_PUBLIC_APP_VERSION from git sha.
 APP_VERSION=
+NEXT_PUBLIC_APP_VERSION=