use sudo for deploy scripts instead of chown on repo

The deploy user runs scripts as root via passwordless sudo,
avoiding ownership conflicts with Docker-mounted volumes.

setup.sh

@@ -86,7 +86,12 @@ if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
     echo "  into /home/deploy/.ssh/authorized_keys"
 fi
 chown -R deploy:deploy /home/deploy/.ssh
-su -s /bin/bash deploy -c "git config --global --add safe.directory $REPO_DIR"
+
+echo "==> Configuring sudo for deploy user..."
+cat > /etc/sudoers.d/deploy <<SUDOERS
+deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy-*.sh
+SUDOERS
+chmod 440 /etc/sudoers.d/deploy
 
 # --- Start services ---