chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

next.config.ts

@@ -16,21 +16,7 @@ const securityHeaders = [
 		key: "Permissions-Policy",
 		value: "camera=(), microphone=(), geolocation=(), interest-cohort=()",
 	},
-	{
-		key: "Content-Security-Policy",
-		value: [
-			"default-src 'self'",
-			"script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://static.cloudflareinsights.com",
-			"style-src 'self' 'unsafe-inline'",
-			"img-src 'self' data: blob: https:",
-			"frame-src 'self' https://challenges.cloudflare.com https://www.google.com/recaptcha/",
-			"connect-src 'self' https: wss:",
-			"font-src 'self' data:",
-			"object-src 'none'",
-			"base-uri 'self'",
-			"form-action 'self'",
-		].join("; "),
-	},
+	// CSP is set per-request in src/proxy.ts with a script nonce (no 'unsafe-inline' for scripts).
 ];
 
 const nextConfig: NextConfig = {