fix: create deployment backups with allowed Docker permissions

scripts/deploy-remote.sh

@@ -48,14 +48,14 @@ backup_dir=/var/backups/personal-website
 backup_stamp=$(date -u +%Y%m%dT%H%M%SZ)
 backup_name="${environment_name}-${backup_stamp}-${sha}.dump"
 sudo docker pull "$backup_image"
-sudo install -d -m 0700 "$backup_dir"
+# The deploy account can run Docker, but has no general host-file sudo access.
+# A bind volume creates the root-owned directory; restrict it before dumping.
 sudo docker run --rm --network backend --env-file "$environment" \
-  --mount "type=bind,source=$backup_dir,target=/backups" \
+  --volume "$backup_dir:/backups" \
   --env "BACKUP_FILE=$backup_name" "$backup_image" \
-  sh -eu -c 'pg_dump --format=custom --no-owner --no-acl --file="/backups/$BACKUP_FILE" "$DB_URL"'
+  sh -eu -c 'chmod 0700 /backups; umask 077; pg_dump --format=custom --no-owner --no-acl --file="/backups/$BACKUP_FILE" "$DB_URL"'
 sudo docker run --rm --mount "type=bind,source=$backup_dir,target=/backups" \
   "$backup_image" pg_restore --list "/backups/$backup_name" >/dev/null
-sudo chmod 0600 "$backup_dir/$backup_name"
 echo "Verified $environment_name database backup at $backup_dir/$backup_name"
 
 run_database_script() {