chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

src/app/(site)/register/page.tsx

@@ -1,4 +1,5 @@
 import { getTranslations } from "next-intl/server";
+import { headers } from "next/headers";
 import { RegisterForm } from "@/components/auth/register-form";
 import { captchaConfig } from "@/lib/services/captcha";
 import { siteSettings } from "@/lib/services/site-settings";
@@ -12,6 +13,7 @@ export default async function RegisterPage({
 }) {
 	const t = await getTranslations("pages.register");
 	const { error } = await searchParams;
+	const nonce = (await headers()).get("x-nonce") ?? undefined;
 
 	const [hotelName, captcha] = await Promise.all([
 		siteSettings.get("hotel_name", "Atom"),
@@ -26,6 +28,7 @@ export default async function RegisterPage({
 					hotelName={hotelName ?? "Atom"}
 					captcha={captcha}
 					error={error}
+					nonce={nonce}
 				/>
 			</div>
 		</main>

src/app/layout.tsx

@@ -1,5 +1,6 @@
 import type { Metadata } from "next";
 import { Nunito, Pixelify_Sans } from "next/font/google";
+import { headers } from "next/headers";
 import Script from "next/script";
 import { NextIntlClientProvider } from "next-intl";
 import { getLocale, getMessages } from "next-intl/server";
@@ -61,6 +62,7 @@ export default async function RootLayout({
 	const messages = await getMessages();
 	const defaultDark = await siteSettings.getBool("default_dark", false);
 	const nitroUrl = await siteSettings.get("nitro_client_url", "");
+	const nonce = (await headers()).get("x-nonce") ?? undefined;
 
 	return (
 		<html
@@ -69,7 +71,11 @@ export default async function RootLayout({
 		>
 			<head>
 				<meta name="theme-default-dark" content={String(defaultDark)} />
-				<Script src="/scripts/theme-init.js" strategy="beforeInteractive" />
+				<Script
+					src="/scripts/theme-init.js"
+					strategy="beforeInteractive"
+					nonce={nonce}
+				/>
 				<link rel="preconnect" href="https://www.habbo.com" />
 				<link rel="dns-prefetch" href="https://www.habbo.com" />
 				{nitroUrl?.startsWith("http") ? (