chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

src/app/layout.tsx

@@ -1,5 +1,6 @@
 import type { Metadata } from "next";
 import { Nunito, Pixelify_Sans } from "next/font/google";
+import { headers } from "next/headers";
 import Script from "next/script";
 import { NextIntlClientProvider } from "next-intl";
 import { getLocale, getMessages } from "next-intl/server";
@@ -61,6 +62,7 @@ export default async function RootLayout({
 	const messages = await getMessages();
 	const defaultDark = await siteSettings.getBool("default_dark", false);
 	const nitroUrl = await siteSettings.get("nitro_client_url", "");
+	const nonce = (await headers()).get("x-nonce") ?? undefined;
 
 	return (
 		<html
@@ -69,7 +71,11 @@ export default async function RootLayout({
 		>
 			<head>
 				<meta name="theme-default-dark" content={String(defaultDark)} />
-				<Script src="/scripts/theme-init.js" strategy="beforeInteractive" />
+				<Script
+					src="/scripts/theme-init.js"
+					strategy="beforeInteractive"
+					nonce={nonce}
+				/>
 				<link rel="preconnect" href="https://www.habbo.com" />
 				<link rel="dns-prefetch" href="https://www.habbo.com" />
 				{nitroUrl?.startsWith("http") ? (