Harden deploy gates, prod AUTH_SECRET, and Sentry error reporting.

Align onlyBuiltDependencies with the workspace, fail fast without AUTH_SECRET in production, and delete catalog_items via VARCHAR-safe SQL so page deletes do not leave orphans.

Co-authored-by: Cursor <[email protected]>

src/env.ts

@@ -80,6 +80,17 @@ const schema = z.object({
 	SENTRY_PROJECT: z.string().optional(),
 	SENTRY_AUTH_TOKEN: z.string().optional(),
 	APP_VERSION: z.string().optional(),
+	NEXT_PUBLIC_APP_VERSION: z.string().optional(),
+}).superRefine((data, ctx) => {
+	if (data.NODE_ENV !== "production") return;
+	if (!data.AUTH_SECRET || data.AUTH_SECRET.length < 32) {
+		ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message:
+				"AUTH_SECRET (>=32 characters) is required when NODE_ENV=production",
+			path: ["AUTH_SECRET"],
+		});
+	}
 });
 
 type Env = z.infer<typeof schema>;