chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

.gitea/workflows/deploy.yaml

@@ -309,4 +309,24 @@ jobs:
             exit 1
           fi
 
+          echo "Waiting for HTTP health check..."
+          HEALTH_URL="${DEPLOY_HEALTH_URL:-http://127.0.0.1:3000/api/health}"
+          HEALTH_OK=0
+          for i in $(seq 1 15); do
+            BODY="$(curl -sf --max-time 5 "${HEALTH_URL}" 2>/dev/null || true)"
+            if echo "${BODY}" | grep -q '"database":true'; then
+              echo "Health OK (${HEALTH_URL})"
+              HEALTH_OK=1
+              break
+            fi
+            echo "Health attempt ${i}/15 failed, retrying..."
+            sleep 2
+          done
+          if [ "${HEALTH_OK}" != "1" ]; then
+            echo "ERROR: Health check failed after deploy (${HEALTH_URL})" >&2
+            echo "Last body: ${BODY:-<empty>}" >&2
+            journalctl -u atom-nexst.service -n 40 --no-pager >&2 || true
+            exit 1
+          fi
+
           echo "--- Deployed successfully ---"