CI grants deploy permissions to the PR test job #219

Problem

.github/workflows/ci-cd.yml sets pages: write and id-token: write at the workflow level, so the test job — which runs npm ci and executes third-party code on every PR — carries deploy credentials it never needs.

Proposal

Move pages: write and id-token: write down to the deploy job; the test job keeps only contents: read.

Please read how to contribute