Fix deploy workflow failure from Docker daemon permission denial on EC2

[Copilot]

The deploy GitHub Actions job was failing in the remote SSH step because Docker Compose commands were executed without Docker daemon access on the EC2 host. This change updates the workflow so deploy commands run with appropriate privileges and tightens workflow token permissions.

• Deploy step privilege correction

  • Switched remote Docker Compose invocations to sudo in .github/workflows/deploy.yml so the SSH user can access /var/run/docker.sock.
  • Applied to build, startup, status, and backend log collection paths.

• Workflow token hardening

  • Added explicit workflow permissions:
    • contents: read
  • Reduces default token scope and satisfies Actions security checks.

permissions:
  contents: read

# inside remote SSH deploy script
sudo docker compose build
sudo docker compose up -d
sudo docker compose ps
# on health-check failure
sudo docker compose logs --tail 200 backend