Self-heal a stale cached bundle via a build version

Phones kept running old JS because their cached index.html pointed at an old
hashed asset. Both images now bake the commit SHA as BUILD_VERSION; the backend
exposes it at GET /api/version and the client reloads once with a cache-busting
query when its own baked version differs. Guarded by sessionStorage so it cannot
loop. /api/version is unauthenticated like /api/health.

frontend/Dockerfile

@@ -1,5 +1,9 @@
 FROM node:22-alpine AS build
 
+# Same value as the backend's BUILD_VERSION so the client can compare them.
+ARG BUILD_VERSION=unknown
+ENV VITE_BUILD_VERSION=${BUILD_VERSION}
+
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci --no-audit --no-fund