fix: add startup.sh with explicit PYTHONPATH for bundled packages

Azure Oryx could not find packages installed to .python_packages/.
Add a startup.sh script that sets PYTHONPATH to include the bundled
package directory before launching gunicorn. Update workflow to set
the Web App startup command to use startup.sh.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/deploy-backend.yml

@@ -20,9 +20,15 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Create deployment package
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies and create package
         run: |
           cd backend
+          pip install -r requirements.txt --target=".python_packages/lib/site-packages"
           zip -r ../deploy.zip . -x ".venv/*" ".env" "__pycache__/*" "*.pyc" ".git/*" "tests/*"
 
       - name: Login to Azure
@@ -32,11 +38,15 @@ jobs:
           tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_62D66D4E65AC4A6C872064AD668AC691 }}
           subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_5D7B0564A55F4209A91149F2642D3F69 }}
 
-      - name: Deploy to Azure Web App (Oryx build)
+      - name: Configure startup command
         run: |
-          az webapp deploy \
+          az webapp config set \
             --name soc-backend \
             --resource-group Operation \
-            --src-path deploy.zip \
-            --type zip \
-            --async false
+            --startup-file startup.sh
+
+      - name: Deploy to Azure Web App
+        uses: azure/webapps-deploy@v3
+        with:
+          app-name: soc-backend
+          package: deploy.zip