chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

src/app/(site)/register/page.tsx

@@ -1,4 +1,5 @@
 import { getTranslations } from "next-intl/server";
+import { headers } from "next/headers";
 import { RegisterForm } from "@/components/auth/register-form";
 import { captchaConfig } from "@/lib/services/captcha";
 import { siteSettings } from "@/lib/services/site-settings";
@@ -12,6 +13,7 @@ export default async function RegisterPage({
 }) {
 	const t = await getTranslations("pages.register");
 	const { error } = await searchParams;
+	const nonce = (await headers()).get("x-nonce") ?? undefined;
 
 	const [hotelName, captcha] = await Promise.all([
 		siteSettings.get("hotel_name", "Atom"),
@@ -26,6 +28,7 @@ export default async function RegisterPage({
 					hotelName={hotelName ?? "Atom"}
 					captcha={captcha}
 					error={error}
+					nonce={nonce}
 				/>
 			</div>
 		</main>