chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

src/actions/save-logo.ts

@@ -58,56 +58,3 @@ export async function saveLogo(
 		};
 	}
 }
-
-export async function saveLogoFromUrl(
-	gifUrl: string,
-): Promise<{ success: boolean; url?: string; error?: string }> {
-	try {
-		const res = await fetch(gifUrl);
-		if (!res.ok)
-			return { success: false, error: `Failed to fetch GIF: ${res.status}` };
-
-		const contentType = res.headers.get("content-type") ?? "image/gif";
-		const buffer = Buffer.from(await res.arrayBuffer());
-
-		const ext =
-			contentType === "image/png"
-				? "png"
-				: contentType === "image/gif"
-					? "gif"
-					: contentType === "image/jpeg"
-						? "jpg"
-						: contentType === "image/webp"
-							? "webp"
-							: "gif";
-		const filename = `logo-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
-		const baseDir = MEDIA_DIR;
-		const filePath = path.resolve(baseDir, filename);
-		if (!filePath.startsWith(baseDir + path.sep)) {
-			return { success: false, error: "Invalid path" };
-		}
-
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
-		await mkdir(baseDir, { recursive: true });
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
-		await writeFile(filePath, buffer);
-
-		const url = `/api/media/logo/${filename}`;
-
-		await prisma.websiteSetting.upsert({
-			where: { key: "cms_logo" },
-			update: { value: url },
-			create: { key: "cms_logo", value: url, comment: "Logo (generator)" },
-		});
-
-		siteSettings.reload();
-		revalidatePath("/", "layout");
-
-		return { success: true, url };
-	} catch (e) {
-		return {
-			success: false,
-			error: e instanceof Error ? e.message : "Unknown error",
-		};
-	}
-}