Expose runtime build metadata

[TKlerx]

Summary

• expose non-secret runtime build metadata via the UI badge and /api/version
• pass metadata through Docker build args/labels, Compose, Azure Container Apps env, and deploy workflow TF_VAR values
• document the env-driven version strategy so dev/staging tracing does not require generated committed files

Validation

• pnpm test -- tests/unit/app-version.test.ts tests/unit/version-route.test.ts tests/unit/security/deploy-workflow.test.ts
• pnpm run typecheck
• .\validate.ps1 all
• .\validate.ps1 quality