chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

src/lib/csp.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { buildContentSecurityPolicy, createCspNonce } from "./csp";
+
+describe("csp", () => {
+	it("creates a non-empty base64 nonce", () => {
+		const nonce = createCspNonce();
+		expect(nonce.length).toBeGreaterThan(8);
+		expect(nonce).toMatch(/^[A-Za-z0-9+/=]+$/);
+	});
+
+	it("uses a script nonce and omits script unsafe-inline", () => {
+		const csp = buildContentSecurityPolicy("testNonce123");
+		expect(csp).toContain("script-src");
+		expect(csp).toContain("'nonce-testNonce123'");
+		expect(csp).not.toMatch(/script-src[^;]*'unsafe-inline'/);
+		expect(csp).toContain("style-src 'self' 'unsafe-inline'");
+		expect(csp).toContain("https://challenges.cloudflare.com");
+		expect(csp).toContain("https://cdn.jsdelivr.net");
+	});
+});