fix: harden update pipeline and restore a clean production build

- update-Nitrov3.sh: build CMS into .next-staging and swap atomically so a
  failed build never takes the live site down; auto-merge new variables
  from .env.example; validate env for duplicates/broken lines; restart the
  emulator/CMS only when rebuilt or unhealthy; fix step renumbering
- next.config.ts: support NEXT_DIST_DIR for staged production builds
- fix all TS errors (unused imports, missing tryDownloadCandidates helper)
  so tsc and the production build pass clean
- add Dockerfile/.dockerignore and switch docker-compose to a CMS container
- include prevailing UI/refactor changes (SurfaceCard, ticketing, tsconfig)

src/actions/admin-housekeeping.ts

@@ -3,21 +3,8 @@
 import { asc } from "drizzle-orm";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteHousekeepingPermissions } from "@/lib/db";
-import { redirectSafe } from "@/lib/foundation/security";
 import { PERMS } from "@/lib/permissions";
 
-/**
- * Housekeeping table writes are retired. Runtime access uses ACL only.
- * Redirect editors to live Permissions.
- */
-async function rejectLegacyHousekeepingWrite(): Promise<never> {
-	await requirePermission(PERMS.SETTINGS_EDIT);
-	return redirectSafe(
-		"/admin/permissions?from=housekeeping",
-		"/admin/permissions",
-	);
-}
-
 export async function exportPermissions(): Promise<string> {
 	await requirePermission(PERMS.SETTINGS_VIEW);
 
@@ -37,7 +24,3 @@ export async function exportPermissions(): Promise<string> {
 
 	return JSON.stringify(perms, null, 2);
 }
-
-export async function applyPreset(_formData: FormData): Promise<void> {
-	return rejectLegacyHousekeepingWrite();
-}