Summary

• Rework the EC2 deploy workflow to build the Spring Boot jar, generate deploy-only config from GitHub Secrets, upload files to EC2, and restart Docker Compose.
• Update Docker Compose to mount external runtime config and secret files on EC2.
• Let Firebase load its service account from an external path and remove Apple client secret logging.
• Add EC2 deployment notes with required secrets and runtime file layout.

Workflow trigger note

Merging this PR to main will make the workflow definition available on main, but it will not automatically deploy because the workflow currently runs on workflow_dispatch or pushes to the deploy branch.

Validation

• ./gradlew build -x test
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/deploy.yml")'

./gradlew test was also attempted locally, but the suite failed because no local MySQL instance was listening; CI is configured to run tests with MySQL 8.