deploy: run the /srv/homepage steps under sudo

The homepage deploy's mkdir/cp/write of /srv/homepage ran as the deploy user
and hit 'Permission denied' (/srv is root-owned). Prefix them with the sudo
wrapper, write deployed.js via a temp file + sudo cp, and chmod the tree
a+rX so Caddy can serve it. Run the one-off checker as root too (it writes
status.json into /srv/homepage).

scripts/deploy.sh

@@ -177,20 +177,22 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   fi
 
   echo '  Deploying the homepage...'
-  mkdir -p /srv/homepage
+  ${SUDO} mkdir -p /srv/homepage
-  cp shared/homepage/index.html shared/homepage/admin.html shared/homepage/app.js \\
+  ${SUDO} cp shared/homepage/index.html shared/homepage/admin.html shared/homepage/app.js \\
      shared/homepage/style.css shared/homepage/services.json /srv/homepage/
-  [ -d shared/homepage/fonts ] && cp -r shared/homepage/fonts /srv/homepage/
+  if [ -d shared/homepage/fonts ]; then ${SUDO} cp -r shared/homepage/fonts /srv/homepage/; fi
   # The last master deployment datetime (Q43): the deployed commit's datetime.
   DEPLOYED_AT=\"\$(git log -1 --format=%cI)\"
-  printf 'window.DEPLOYED_AT = \"%s\";\\n' \"\$DEPLOYED_AT\" > /srv/homepage/deployed.js
+  printf 'window.DEPLOYED_AT = \"%s\";\\n' \"\$DEPLOYED_AT\" > /tmp/deployed.js
+  ${SUDO} cp /tmp/deployed.js /srv/homepage/deployed.js
+  ${SUDO} chmod -R a+rX /srv/homepage
   # The status checker: install the timer + service, run it once, enable it.
   ${SUDO} cp scripts/homepage-status.py /usr/local/bin/homepage-status.py
   ${SUDO} cp scripts/homepage-status.service scripts/homepage-status.timer /etc/systemd/system/
   ${SUDO} systemctl daemon-reload
   ${SUDO} systemctl enable homepage-status.timer
   ${SUDO} systemctl restart homepage-status.timer
-  python3 /usr/local/bin/homepage-status.py /srv/homepage/services.json /srv/homepage/status.json
+  ${SUDO} python3 /usr/local/bin/homepage-status.py /srv/homepage/services.json /srv/homepage/status.json
 fi
 
 if [ '${COMPOSE_UP[$TARGET]}' = '1' ]; then