fix(version): read app version from the committed VERSION file

Make APP_VERSION come from the VERSION file (Dockerfile reads it for the SPA build
and ships it for the backend to read at runtime) instead of depending solely on a
deploy-time build-arg. This keeps the version correct even for a plain
`docker compose build` and removes the first-deploy bootstrap gap. git_sha/build_date
stay best-effort build-args.

backend/app/config.py

@@ -1,3 +1,5 @@
+from pathlib import Path
+
 from pydantic import model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -5,13 +7,26 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 _DEFAULT_SECRET_KEY = "change-me-session-key"
 
 
+def _version_from_file() -> str:
+    """The committed VERSION file (copied into the image at /app/VERSION) is the single
+    source of truth for the app version; falls back to 'dev' for un-built/local runs."""
+    for p in (Path(__file__).resolve().parents[1] / "VERSION", Path("VERSION")):
+        try:
+            v = p.read_text(encoding="utf-8").strip()
+            if v:
+                return v
+        except OSError:
+            continue
+    return "dev"
+
+
 class Settings(BaseSettings):
     model_config = SettingsConfigDict(env_file=".env", extra="ignore")
 
     app_name: str = "Siftlode"
-    # Build/version info, injected at image build time (Docker build-args -> env). Defaults
-    # apply for un-built/dev runs; the About dialog and version banner surface these.
-    app_version: str = "dev"
+    # Version from the committed VERSION file (an explicit APP_VERSION env still overrides);
+    # git_sha/build_date are injected at image build time. Surfaced by /api/version.
+    app_version: str = _version_from_file()
     git_sha: str = "unknown"
     build_date: str = ""