ci(deploy): a log diagnostic must not fail a deploy that worked

deploy-web failed on run 27 after every health check had passed. The
service was live, the frontend was serving, the public vhost was
answering and /metrics was closed -- and then the job went red because
`tail` could not read an nginx log.

5244585 dropped sudo here on the premise that "nginx's logs are
world-readable and /var/log/nginx is traversable". Half right:
/var/log/nginx is drwx--x--x, so traversable but not listable, and
logrotate creates the files 0640 nginx:root. The deploy account cannot
read them as itself at all, so the step could only ever have failed.

Try sudo, say so plainly when it is not permitted, and mark the step
continue-on-error. A step that exists to print context after a deploy
should never be able to fail one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqNtYNhov3fukx46KS9R7L

.gitea/workflows/deploy.yml

@@ -360,14 +360,18 @@ jobs:
             fi'
           echo "frontend and API both answering through rf.internal"
 
-      # No sudo: nginx's logs are world-readable and /var/log/nginx is
-      # traversable, so the deploy account can read them as itself. Reaching
-      # for sudo here would have meant widening the scoped whitelist for
-      # something it does not need.
+      # A diagnostic, and diagnostics must not fail a deploy that worked --
+      # which is exactly what happened when this was assumed to be readable
+      # without sudo. /var/log/nginx is drwx--x--x (traversable but not
+      # listable) and logrotate creates the files 0640 nginx:root, so the
+      # deploy account cannot read them as itself. Try sudo, fall back to
+      # saying so, and never exit non-zero either way.
       - name: nginx log
         if: always() && steps.auth.outcome == 'success'
+        continue-on-error: true
         run: |
           for log in rf.internal rustingface.com; do
             echo "--- /var/log/nginx/$log.error.log"
-            ssh "$PROXY_HOST" "tail -n 30 /var/log/nginx/$log.error.log"
+            ssh "$PROXY_HOST" "sudo -n tail -n 30 /var/log/nginx/$log.error.log 2>/dev/null \
+              || echo '(not readable by the deploy account; add tail to its sudo allowlist to see this)'"
           done