fix: bake APP_VERSION into image as build arg instead of runtime env

- Dockerfile: ARG/ENV APP_VERSION, copies VERSION file
- compose: passes build arg, removes runtime env var
- webui: reads VERSION file as fallback if env not set
- deploy: explicit build step with --build-arg

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -40,13 +40,13 @@ jobs:
           OUTLINE_URL=http://172.29.0.13:3000
           OUTLINE_TOKEN=${{ secrets.OUTLINE_TOKEN }}
           TS_AUTHKEY=${{ secrets.TS_AUTHKEY }}
-          APP_VERSION=${{ env.APP_VERSION }}
           EOF
 
       - name: Deploy with docker compose
         run: |
           echo "=== Deploying ${{ env.APP_VERSION }} (commit ${{ gitea.sha }}) to ${{ gitea.ref_name }} ==="
-          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up --build -d --remove-orphans
+          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" build --build-arg APP_VERSION=${{ env.APP_VERSION }}
+          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up -d --remove-orphans
 
       - name: Prune dangling images
         run: docker image prune -f