Self-heal a stale cached bundle via a build version

Phones kept running old JS because their cached index.html pointed at an old
hashed asset. Both images now bake the commit SHA as BUILD_VERSION; the backend
exposes it at GET /api/version and the client reloads once with a cache-busting
query when its own baked version differs. Guarded by sessionStorage so it cannot
loop. /api/version is unauthenticated like /api/health.

frontend/src/api.js

@@ -2,6 +2,7 @@ import axios from 'axios'
 
 const http = axios.create({ baseURL: '/api', timeout: 10000 })
 
+export const getVersion = () => http.get('/version').then((r) => r.data)
 export const getStatus = () => http.get('/status').then((r) => r.data)
 export const getStrategies = () => http.get('/strategies').then((r) => r.data)
 export const getPositions = () => http.get('/positions').then((r) => r.data)