ci: auto-heal session pass-cli avant make env

Appelle /opt/infra/scripts/ensure-pass-session.sh (auto-recovery via recovery
PAT) avant make env → plus de deploy cassé par « session invalidated ».

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -23,6 +23,9 @@ jobs:
             cd /opt/projects/info-canicule
             git fetch --prune origin main
             git reset --hard origin/main
+            # Auto-répare la session pass-cli expirée avant de rendre le .env,
+            # sinon « Your session has been invalidated » (cf. infra scripts/ensure-pass-session.sh).
+            [ -x /opt/infra/scripts/ensure-pass-session.sh ] && /opt/infra/scripts/ensure-pass-session.sh || true
             make env
             docker compose up -d --build --wait
             docker image prune -f