fix: harden update pipeline and restore a clean production build

- update-Nitrov3.sh: build CMS into .next-staging and swap atomically so a
  failed build never takes the live site down; auto-merge new variables
  from .env.example; validate env for duplicates/broken lines; restart the
  emulator/CMS only when rebuilt or unhealthy; fix step renumbering
- next.config.ts: support NEXT_DIST_DIR for staged production builds
- fix all TS errors (unused imports, missing tryDownloadCandidates helper)
  so tsc and the production build pass clean
- add Dockerfile/.dockerignore and switch docker-compose to a CMS container
- include prevailing UI/refactor changes (SurfaceCard, ticketing, tsconfig)

src/lib/services/import/core/download.ts

@@ -18,6 +18,18 @@ export function validatePngBytes(buffer: Buffer): boolean {
 	);
 }
 
+export async function tryDownloadCandidates(
+	urls: string[],
+	destPath: string,
+	kind: "swf" | "png",
+): Promise<boolean> {
+	for (const url of urls) {
+		const res = await downloadFile(url, destPath, { validate: kind });
+		if (res.ok) return true;
+	}
+	return false;
+}
+
 export async function downloadFile(
 	url: string,
 	destPath: string,