Scope deploy workflow secrets

[denuoweb]

Summary

• remove deploy credentials from job-level env so they are not present in unrelated step logs
• validate required secret presence with boolean flags instead of exposing secret values
• pass Firebase, Stripe, device-token, frontend, and bootstrap env only to the steps that require them

Verification

• python3 YAML parse for .github/workflows/deploy.yml
• actionlint .github/workflows/deploy.yml
• nvm exec 24.15.0 pnpm lint
• nvm exec 24.15.0 pnpm --filter crowdpm-functions test