fix: bake APP_VERSION into image as build arg instead of runtime env

- Dockerfile: ARG/ENV APP_VERSION, copies VERSION file
- compose: passes build arg, removes runtime env var
- webui: reads VERSION file as fallback if env not set
- deploy: explicit build step with --build-arg

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

webui.py

@@ -30,7 +30,14 @@ from pydantic import BaseModel, field_validator
 
 VAULT_DIR: Path = Path(os.environ.get("VAULT_DIR", "/vault"))
 SETTINGS_PATH: Path = Path(os.environ.get("SETTINGS_PATH", "/work/settings.json"))
-APP_VERSION: str = os.environ.get("APP_VERSION", "dev")
+def _read_version() -> str:
+    v = os.environ.get("APP_VERSION", "")
+    if v:
+        return v
+    vf = Path(__file__).parent / "VERSION"
+    return vf.read_text().strip() if vf.exists() else "dev"
+
+APP_VERSION: str = _read_version()
 
 # ---------------------------------------------------------------------------
 # App + job state