feat: expose deploy version (git SHA) on CMS and health endpoint

'Is the fix live?' becomes a single check instead of an SSH session:

- CMS: git short SHA read at startup, shown in the bottom bar (v<sha>),
  served by the public GET /version endpoint, recorded in a startup audit
  entry
- Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it
  via build ARG into the runtime env, /api/health reports it as
  deployVersion, smoke test asserts a non-'unversioned' stamp

Closes MITHOME-63

docker-compose.prod.yml

@@ -7,6 +7,7 @@ services:
       target: runner  # Use runner stage for production (smaller size, no dev dependencies)
       args:
         - NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL:-https://mozdit.hu}
+        - DEPLOY_VERSION=${DEPLOY_VERSION:-unversioned}
     container_name: mozdit-app-prod
     ports:
       - "8080:3000" # Host port 8080 elkerüli a lokális npm dev (3000) összeakadást