Self-heal a stale cached bundle via a build version

Phones kept running old JS because their cached index.html pointed at an old
hashed asset. Both images now bake the commit SHA as BUILD_VERSION; the backend
exposes it at GET /api/version and the client reloads once with a cache-busting
query when its own baked version differs. Guarded by sessionStorage so it cannot
loop. /api/version is unauthenticated like /api/health.

backend/tests/test_api.py

@@ -9,6 +9,13 @@ from app.market.fake import FakeMarketData
 from app.runtime import Runtime
 
 
+def test_version_endpoint(runtime: Runtime) -> None:
+    app = create_app(runtime.settings, runtime)
+    with TestClient(app) as client:
+        assert client.get("/api/version").status_code == 200
+        assert "version" in client.get("/api/version").json()
+
+
 def test_health_and_strategies(runtime: Runtime) -> None:
     app = create_app(runtime.settings, runtime)
     with TestClient(app) as client: