chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

src/lib/deploy-workflow-contract.test.ts

@@ -62,4 +62,16 @@ describe("production deploy workflow", () => {
 			'export NEXT_PUBLIC_APP_VERSION="$' + "{APP_VERSION}\"",
 		);
 	});
+
+	it("runs an HTTP health check before declaring deploy success", () => {
+		expect(workflow).toContain("/api/health");
+		expect(workflow).toContain('"database":true');
+		const deployJob = workflow.slice(workflow.indexOf("\n  deploy:"));
+		const startAt = deployJob.indexOf("systemctl start atom-nexst.service");
+		const healthAt = deployJob.indexOf("/api/health");
+		const successAt = deployJob.indexOf("--- Deployed successfully ---");
+		expect(startAt).toBeGreaterThan(-1);
+		expect(healthAt).toBeGreaterThan(startAt);
+		expect(successAt).toBeGreaterThan(healthAt);
+	});
 });