fix: add id-token permission and fix zip package root path

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/deploy-backend.yml

@@ -8,6 +8,10 @@ on:
       - ".github/workflows/deploy-backend.yml"
   workflow_dispatch:
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
@@ -25,8 +29,7 @@ jobs:
         run: |
           cd backend
           pip install -r requirements.txt --target=".python_packages/lib/site-packages"
-          cd ..
-          zip -r deploy.zip backend/ -x "backend/.venv/*" "backend/.env" "backend/__pycache__/*" "backend/*.pyc"
+          zip -r ../deploy.zip . -x ".venv/*" ".env" "__pycache__/*" "*.pyc"
 
       - name: Login to Azure
         uses: azure/login@v2