feat: expose deploy version (git SHA) on CMS and health endpoint

'Is the fix live?' becomes a single check instead of an SSH session:

- CMS: git short SHA read at startup, shown in the bottom bar (v<sha>),
  served by the public GET /version endpoint, recorded in a startup audit
  entry
- Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it
  via build ARG into the runtime env, /api/health reports it as
  deployVersion, smoke test asserts a non-'unversioned' stamp

Closes MITHOME-63

content-editor.js

@@ -11,7 +11,7 @@
 const http = require('http');
 const fs = require('fs');
 const path = require('path');
-const { exec } = require('child_process');
+const { exec, execSync } = require('child_process');
 const crypto = require('crypto');
 const { validateContent } = require('./proto/src/content/schema');
 const { renderMarkdown } = require('./scripts/markdown-render');
@@ -133,6 +133,17 @@ function backupAndWriteAtomically(targetFile, data, backupDir = BACKUP_DIR) {
   return backupFile;
 }
 
+// Deploy version = git short SHA of the checked-out commit. Read once at startup:
+// a CMS "deploy" is git pull + service restart, so this identifies the running code.
+function readDeployVersion() {
+  try {
+    return execSync('git rev-parse --short HEAD', { cwd: __dirname, encoding: 'utf8' }).trim();
+  } catch {
+    return 'unknown';
+  }
+}
+const DEPLOY_VERSION = readDeployVersion();
+
 const server = http.createServer(async (req, res) => {
   const clientAddress = getClientAddress(req);
   if (!securityConfigIsValid()) {
@@ -167,6 +178,13 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
+  // Public: deploy version (git SHA only — no secrets) for quick "is the fix live?" checks.
+  if (req.method === 'GET' && u.pathname === '/version') {
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify({ version: DEPLOY_VERSION, env: CMS_DEPLOY_ENV }));
+    return;
+  }
+
   // Public: styled login page (shown after logout and for unauthenticated browser visits).
   if (req.method === 'GET' && u.pathname === '/login') {
     res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
@@ -366,7 +384,7 @@ const server = http.createServer(async (req, res) => {
   const contentHash = crypto.createHash('sha256').update(jsonData).digest('hex');
 
   res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-  res.end(HTML(activeFile, jsonData, message, CSRF_TOKEN, FILE_LABELS, clientJs, contentHash));
+  res.end(HTML(activeFile, jsonData, message, CSRF_TOKEN, FILE_LABELS, clientJs, contentHash, DEPLOY_VERSION));
 });
 
 if (require.main === module) {
@@ -374,7 +392,8 @@ if (require.main === module) {
     throw new Error('CMS_USER, CMS_PASS és érvényes CMS_DEPLOY_ENV nélkül a Content Editor nem indítható el.');
   }
   server.listen(PORT, '127.0.0.1', () => {
-    console.log(`\n✅ mozdIT Content Editor fut: http://localhost:${PORT}\n`);
+    writeAudit('startup', { version: DEPLOY_VERSION, env: CMS_DEPLOY_ENV });
+    console.log(`\n✅ mozdIT Content Editor fut: http://localhost:${PORT} (v${DEPLOY_VERSION})\n`);
     console.log('   Szerkeszthető fájlok:');
     Object.entries(FILE_LABELS).forEach(([k, l]) => {
       const rel = k === 'common' ? 'common.json' : `pages/${k}.json`;