chore: CSP script nonces, deploy health check, dead-code cleanup

Add per-request CSP nonces (drop script unsafe-inline), post-deploy /api/health gate, bump next-auth to beta.32, and remove unused motion/cache/permission helpers.

Co-authored-by: Cursor <[email protected]>

src/lib/permissions.ts

@@ -203,79 +203,3 @@ export function canAccess(
 ): boolean {
 	return permissions.has(slug);
 }
-
-/**
- * For mod panel server components: get session + load permissions.
- * Redirects to login if unauthenticated and to / without moderator ACL access.
- */
-export async function getModContext() {
-	const session = await auth();
-	if (!session?.user) {
-		redirectSafe("/login", "/login");
-	}
-
-	const userId = sessionUserId(session.user.id);
-	if (!userId) redirectSafe("/login", "/login");
-	const state = await getCurrentAuthorizationState(userId);
-	if (!state) redirectSafe("/", "/");
-	const permissions = await loadUserPermissions(
-		userId,
-		state.actor.rank,
-		state.highestRank,
-	);
-	if (!canAccess(permissions, PERMS.MOD_DASHBOARD)) redirectSafe("/", "/");
-	return {
-		session: {
-			...session,
-			user: {
-				...session.user,
-				id: userId,
-				username: state.actor.username,
-				rank: state.actor.rank,
-			},
-		},
-		permissions,
-	};
-}
-
-// ── Legacy single-check functions (kept for backward compatibility) ──
-
-/** Check if a user has a CMS permission using their current database rank. */
-export async function checkPermission(
-	userId: number,
-	_rank: number,
-	permission: string,
-): Promise<boolean> {
-	const state = await getCurrentAuthorizationState(userId);
-	if (!state) return false;
-	const perms = await loadUserPermissions(
-		userId,
-		state.actor.rank,
-		state.highestRank,
-	);
-	return perms.has(permission);
-}
-
-/** Check multiple permissions (user needs ALL of them) */
-export async function checkAllPermissions(
-	userId: number,
-	_rank: number,
-	permissions: string[],
-): Promise<boolean> {
-	const state = await getCurrentAuthorizationState(userId);
-	if (!state) return false;
-	const perms = await loadUserPermissions(
-		userId,
-		state.actor.rank,
-		state.highestRank,
-	);
-	return perms.hasAll(...permissions);
-}
-
-/** Check if user has admin access */
-export async function hasAdminAccess(
-	userId: number,
-	rank: number,
-): Promise<boolean> {
-	return checkPermission(userId, rank, PERMS.ADMIN_DASHBOARD);
-}