Force-recreate containers on deploy and verify the served build

The frontend container was serving the very first build (498-byte index.html)
through every later deploy: `docker compose up -d` did not replace a
config-identical service. Deploy now uses `build --pull` and
`up --force-recreate`, the frontend image writes a .build-version marker, and
the workflow fails the deploy if the served marker != the commit SHA.

frontend/Dockerfile

@@ -19,4 +19,9 @@ ENV API_TOKEN=
 
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/templates/default.conf.template
+
+# Marker so the deploy can verify the served build matches the commit.
+ARG BUILD_VERSION=unknown
+RUN printf '%s' "${BUILD_VERSION}" > /usr/share/nginx/html/.build-version
+
 EXPOSE 80