fix: use --env-vars-file to avoid comma/URL parsing issues in gcloud

--set-env-vars chokes on commas inside CORS_ALLOWED_ORIGINS value.
Switched to --env-vars-file with a YAML file written at deploy time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Uttam-Mahata

.github/workflows/backend-deploy-gcf.yml

@@ -42,6 +42,17 @@ jobs:
             artifactregistry.googleapis.com \
             --project=rootaccessctf
 
+      - name: Write env-vars file
+        run: |
+          cat > /tmp/gcf-env.yaml <<'EOF'
+          APP_ENV: "production"
+          PORT: "8080"
+          TRUSTED_PROXIES: "*"
+          AWS_SSM_PATH: "/RootAccess/Backend"
+          AWS_REGION: "us-east-1"
+          CORS_ALLOWED_ORIGINS: "https://rootaccessctf.web.app,https://rootaccess.live,https://ctf.rootaccess.live"
+          EOF
+
       - name: Deploy Cloud Function
         run: |
           gcloud functions deploy rootaccess-api \
@@ -57,7 +68,7 @@ jobs:
             --timeout=60s \
             --min-instances=0 \
             --max-instances=10 \
-            --set-env-vars="APP_ENV=production,PORT=8080,TRUSTED_PROXIES=*,AWS_SSM_PATH=/RootAccess/Backend,AWS_REGION=us-east-1,CORS_ALLOWED_ORIGINS=https://rootaccessctf.web.app,https://rootaccess.live,https://ctf.rootaccess.live" \
+            --env-vars-file=/tmp/gcf-env.yaml \
             --set-secrets="AWS_ACCESS_KEY_ID=gcf-aws-access-key-id:latest,AWS_SECRET_ACCESS_KEY=gcf-aws-secret-access-key:latest"
 
       - name: Get GCF URL