deploy: write the books compose override in the deploy account home

Run #79 failed at "sudo tee /opt/personal-website/compose.books.yml": the deploy
account may only sudo-tee .env. Write the override to ~deploy instead; the
compose CLI runs as root and reads it from there.

scripts/deploy-remote.sh

@@ -32,14 +32,18 @@ fi
 # Book files (ebooks + covers) live on the host and are bind-mounted read-only at /books;
 # the app streams them only to the owner via /trackers/books/files/<id> (no static path).
 # Layout: $books_host_dir/library/<files.path> and $books_host_dir/covers/<works.cover_path>.
-# compose.prod.yml is host-managed, so the mount goes in a generated override file.
+# compose.prod.yml is host-managed, so the mount goes in a generated override file (~deploy).
 books_host_dir=${BOOKS_HOST_DIR:-/home/stan/books}
 case "$books_host_dir" in /*) ;; *) echo 'BOOKS_HOST_DIR must be absolute' >&2; exit 2 ;; esac
 # The deploy account can't traverse /home/stan (0750); check from a root container instead.
 if sudo docker run --rm --entrypoint sh \
   --mount "type=bind,source=$books_host_dir,target=/books,readonly" "$image" \
   -c 'test -d /books/library' 2>/dev/null; then
-  sudo tee "$directory/compose.books.yml" >/dev/null <<YAML
+  # The deploy account may only sudo-tee $directory/.env, so the override lives in its home;
+  # the compose CLI runs as root and can read it from there.
+  books_override="$HOME/compose.books.yml"
+  rm -f "$books_override"
+  cat >"$books_override" <<YAML
 services:
   app:
     environment:
@@ -50,7 +54,7 @@ services:
         target: /books
         read_only: true
 YAML
-  compose_files+=(-f "$directory/compose.books.yml")
+  compose_files+=(-f "$books_override")
 else
   echo "No $books_host_dir/library on this host; book files will not be readable" >&2
 fi