- Changed aws-region from us-east-2 to us-east-1 for correct deployment
- Updated S3 website URL to use us-east-1 endpoint
- Added note about CloudFlare proxy for production serving
- Replace hardcoded AWS role ARN with CC_OIDC_ROLE secret
- Improves security by not exposing AWS account details in workflow
- Makes the workflow more portable and configurable