chore: cleanup deploy

[Akatuoro]

Improve the deployment. --ws-pack does not pack the workspace root, so we still need a manual pack in the mta.yaml. Just reduced the complexity of it.
The preview is now dependent on cds.env.server.index instead of the production profile -> also visible in deployment if activated.

[hyperspace-pr-bot]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

chore: Simplify Deployment & CSRF Support in Preview UI

Refactor and Bug Fix

This PR streamlines the deployment pipeline and improves the preview chat UI.

🚀 Deployment Cleanup (mta.yaml)

• Replaced the fragile deploy-patches.js apply/revert workflow with a simpler build sequence using --ws-pack
• Since --ws-pack doesn't pack the workspace root, added an explicit npm pack step targeting gen/srv, followed by a find+npm i to install the packed tarball
• Removed the after-all revert step entirely
• Replaced the joule-cap-proxy existing service reference with a proper bookshop-ai managed service (aicore / extended plan)

🔧 Preview Visibility Logic (lib/index.js)

• Changed the condition for showing the Preview link from !cds.env.profiles?.includes("production") to cds.env?.server?.index
• This makes preview visibility consistent with the CDS index page setting rather than tied to the production profile — applicable in any environment where server.index is enabled

🔐 CSRF Token Support in Chat UI (lib/preview/chat.html)

• Added fetchCsrfToken() to fetch an x-csrf-token via a HEAD / request (lazy, cached on document.csrfToken)
• Updated authHeaders() to be async and include the CSRF token in all POST requests (resume, send, cancel)

🧹 Misc Cleanup

• Removed deploy-patches.js and related .gitignore entries for cap-js-agents-*.tgz and patch backup files
• Updated package.json dependency for @cap-js/agents from a local file path to "*" (resolved via workspace packing)
• Added [production] profile config in package.json enabling server.index: true

Have you...

• Added relevant entry to the change log?

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.29.26

• LLM: anthropic--claude-4.6-sonnet
• Event Trigger: pull_request.opened
• Summary Prompt: Default Prompt
• File Content Strategy: Full file content
• Correlation ID: 49bccf70-97ed-11f1-9a5e-3face523e477
• Output Template: Repository PR Template