Harden deploy gates, prod AUTH_SECRET, and Sentry error reporting.

Align onlyBuiltDependencies with the workspace, fail fast without AUTH_SECRET in production, and delete catalog_items via VARCHAR-safe SQL so page deletes do not leave orphans.

Co-authored-by: Cursor <[email protected]>

src/lib/api-response.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { ZodError, type z } from "zod";
+import { reportError } from "@/lib/report-error";
 
 /** Throwable API error with HTTP status code */
 export class ApiError extends Error {
@@ -46,11 +47,6 @@ export function handleApiError(error: unknown): Response {
 	) {
 		return apiError("Not found", 404);
 	}
-	console.error(
-		"[API error]",
-		error instanceof Error
-			? { message: error.message, name: error.name }
-			: error,
-	);
+	reportError(error, "API error");
 	return apiError("Internal server error", 500);
 }