ci(deploy): install SKILLS_GITHUB_TOKEN as GITHUB_TOKEN in the backend .env (#160)

The gateway's SKILL.md backfill (skill_content.py) calls the GitHub API
unauthenticated from one EC2 IP — 60 req/hr shared across every user. Write
the SKILLS_GITHUB_TOKEN secret into the host .env on deploy (replace-on-
deploy, so rotating the secret rotates the host; skipped when unset). The
Convex-side skill imports get the same token via the Convex env directly.

(cherry picked from commit b6b74a5)

Author: DIodide

.github/workflows/backend-cd.yml

@@ -80,6 +80,13 @@ jobs:
             # REDIS_URL just disables live-following fan-out.
             grep -q '^REDIS_URL=' .env 2>/dev/null || \
               echo 'REDIS_URL=redis://127.0.0.1:6379/${{ steps.env.outputs.redis_db }}' >> .env
+            # GitHub token for the gateway's SKILL.md backfill (raises the API
+            # rate limit from 60/hr/IP to 5000/hr). Replace-on-deploy so
+            # rotating the SKILLS_GITHUB_TOKEN secret rotates the host.
+            if [ -n '${{ secrets.SKILLS_GITHUB_TOKEN }}' ]; then
+              sed -i '/^GITHUB_TOKEN=/d' .env 2>/dev/null || true
+              echo 'GITHUB_TOKEN=${{ secrets.SKILLS_GITHUB_TOKEN }}' >> .env
+            fi
             python3.11 -m venv .venv 2>/dev/null || true
             .venv/bin/pip install -q -r requirements.txt
             sudo systemctl restart ${{ steps.env.outputs.service }}