Health checks reais, cabeçalhos de segurança e Sentry por ambiente

- `/api/health/live` não toca dependência: distingue processo vivo de
  dependência fora do ar. `/api/health/ready` passou a tocar banco, migrations
  pendentes, Redis com PING, bucket com listagem, configuração e modo de job,
  e reporta em `reasons` só o nome do erro — nunca connection string.
- Configuração inválida encerra o processo. Antes o servidor ficava no ar
  respondendo 500 em todas as rotas, inclusive no liveness, enganando o
  orquestrador: pior que não subir.
- CSP, HSTS, Permissions-Policy e COOP, além dos três cabeçalhos que já
  existiam. `unsafe-inline` em script-src é exigência do bootstrap do App
  Router sem nonce; o resto é fechado e connect-src só aceita o próprio host,
  o Supabase do ambiente e o Sentry.
- `onRequestError` registrado: sem esse export os erros de rota e de render
  do servidor não chegavam ao Sentry. O ambiente do evento deriva de
  ADAPTER_ENV, então homologação e produção não se misturam.
- `withSentryConfig` só atua quando organização, projeto e token existem no
  build, para não quebrar build local nem CI.
- `output: "standalone"` para a imagem de runtime.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/app/api/spreadsheet-adapter/jobs/[id]/download/route.ts

@@ -8,7 +8,7 @@ export const dynamic = "force-dynamic";
 
 export async function GET(request: Request, context: { params: Promise<{ id: string }> }) {
   try {
-    const { ctx, deps } = await requireReady();
+    const { ctx, deps } = await requireReady("download");
     const { id } = await context.params;
     const url = new URL(request.url);
     const format = url.searchParams.get("format") as OutputFormat | null;

src/app/api/spreadsheet-adapter/jobs/[id]/mappings/route.ts

@@ -8,7 +8,7 @@ export const dynamic = "force-dynamic";
 
 export async function PUT(request: Request, context: { params: Promise<{ id: string }> }) {
   try {
-    const { ctx, deps } = await requireReady();
+    const { ctx, deps } = await requireReady("mutation");
     const { id } = await context.params;
     const body = (await request.json()) as { sourceId?: string; mappings?: MappingInput[]; workspace_id?: string };
     await rejectWorkspaceForgery(deps, ctx, body.workspace_id);

src/app/api/spreadsheet-adapter/jobs/[id]/preview/route.ts

@@ -7,7 +7,7 @@ export const dynamic = "force-dynamic";
 
 export async function POST(request: Request, context: { params: Promise<{ id: string }> }) {
   try {
-    const { ctx, deps } = await requireReady();
+    const { ctx, deps } = await requireReady("mutation");
     const { id } = await context.params;
     const body = (await request.json()) as { sourceId?: string; workspace_id?: string };
     await rejectWorkspaceForgery(deps, ctx, body.workspace_id);

src/app/api/spreadsheet-adapter/jobs/[id]/process/route.ts

@@ -7,7 +7,7 @@ export const dynamic = "force-dynamic";
 
 export async function POST(request: Request, context: { params: Promise<{ id: string }> }) {
   try {
-    const { ctx, deps } = await requireReady();
+    const { ctx, deps } = await requireReady("process");
     const { id } = await context.params;
     const body = (await request.json()) as { sourceId?: string; idempotencyKey?: string; workspace_id?: string };
     await rejectWorkspaceForgery(deps, ctx, body.workspace_id);

src/app/api/spreadsheet-adapter/jobs/[id]/route.ts

@@ -7,7 +7,7 @@ export const dynamic = "force-dynamic";
 
 export async function GET(_request: Request, context: { params: Promise<{ id: string }> }) {
   try {
-    const { ctx, deps } = await requireReady();
+    const { ctx, deps } = await requireReady("read");
     const { id } = await context.params;
     return NextResponse.json({ job: await getJob(deps, ctx, id) });
   } catch (error) {

src/app/api/spreadsheet-adapter/jobs/[id]/sources/[sourceId]/route.ts

@@ -7,7 +7,7 @@ export const dynamic = "force-dynamic";
 
 export async function PATCH(request: Request, context: { params: Promise<{ id: string; sourceId: string }> }) {
   try {
-    const { ctx, deps } = await requireReady();
+    const { ctx, deps } = await requireReady("mutation");
     const { id, sourceId } = await context.params;
     const body = (await request.json()) as { sheet?: string | null; headerRow?: number; workspace_id?: string };
     await rejectWorkspaceForgery(deps, ctx, body.workspace_id);
@@ -20,7 +20,7 @@ export async function PATCH(request: Request, context: { params: Promise<{ id: s
 
 export async function DELETE(request: Request, context: { params: Promise<{ id: string; sourceId: string }> }) {
   try {
-    const { ctx, deps } = await requireReady();
+    const { ctx, deps } = await requireReady("mutation");
     const { id, sourceId } = await context.params;
     const body = await request.json().catch(() => ({}));
     await rejectWorkspaceForgery(deps, ctx, (body as { workspace_id?: string }).workspace_id);

src/app/api/spreadsheet-adapter/jobs/route.ts

@@ -7,7 +7,7 @@ export const dynamic = "force-dynamic";
 
 export async function POST(request: Request) {
   try {
-    const { ctx, deps } = await requireReady();
+    const { ctx, deps } = await requireReady("mutation");
     const body = (await request.json()) as { modelId?: string; idempotencyKey?: string; workspace_id?: string };
     await rejectWorkspaceForgery(deps, ctx, body.workspace_id);
     if (!body.modelId) return NextResponse.json({ error: { code: "NOT_FOUND", message: "Selecione um modelo." } }, { status: 400 });