fix: bake APP_VERSION into image as build arg instead of runtime env

- Dockerfile: ARG/ENV APP_VERSION, copies VERSION file
- compose: passes build arg, removes runtime env var
- webui: reads VERSION file as fallback if env not set
- deploy: explicit build step with --build-arg

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -30,7 +30,10 @@ services:
       - "traefik.http.services.outline-sync.loadbalancer.server.port=8080"
 
   outline-sync-ui:
-    build: .
+    build:
+      context: .
+      args:
+        APP_VERSION: ${APP_VERSION:-dev}
     container_name: outline-sync-ui
     restart: unless-stopped
     depends_on:
@@ -39,7 +42,6 @@ services:
     environment:
       - OUTLINE_URL=${OUTLINE_URL:-http://172.29.0.13:3000}
       - OUTLINE_TOKEN=${OUTLINE_TOKEN}
-      - APP_VERSION=${APP_VERSION:-dev}
 
 volumes:
   tailscale-state: