feat: expose deploy version (git SHA) on CMS and health endpoint

'Is the fix live?' becomes a single check instead of an SSH session:

- CMS: git short SHA read at startup, shown in the bottom bar (v<sha>),
  served by the public GET /version endpoint, recorded in a startup audit
  entry
- Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it
  via build ARG into the runtime env, /api/health reports it as
  deployVersion, smoke test asserts a non-'unversioned' stamp

Closes MITHOME-63

proto/Dockerfile

@@ -10,6 +10,10 @@ ENV NEXT_PUBLIC_SITE_URL=$NEXT_PUBLIC_SITE_URL
 ARG NEXT_PUBLIC_DEPLOY_ENV
 ENV NEXT_PUBLIC_DEPLOY_ENV=$NEXT_PUBLIC_DEPLOY_ENV
 
+# Runtime-only deploy version (git SHA passed by deploy.sh) — exposed via /api/health.
+ARG DEPLOY_VERSION
+ENV DEPLOY_VERSION=$DEPLOY_VERSION
+
 # Copy package files
 COPY package.json package-lock.json* ./
 

proto/e2e/staging-smoke.spec.ts

@@ -4,7 +4,11 @@ test('SMOKE-01: health endpoint is available', async ({ request }) => {
   const response = await request.get('/api/health')
   expect(response.status()).toBe(200)
   await expect(response).toBeOK()
+  const body = await response.json()
   await expect(response.json()).resolves.toMatchObject({ status: 'ok' })
+  // The deployed build must carry a git SHA stamp (deploy.sh injects it).
+  expect(typeof body.deployVersion).toBe('string')
+  expect(body.deployVersion).not.toBe('unversioned')
 })
 
 test('SMOKE-02: homepage renders its critical shell without console errors', async ({ page }) => {

proto/src/app/api/health/route.ts

@@ -8,6 +8,9 @@ export async function GET() {
       timestamp: new Date().toISOString(),
       uptime: process.uptime(),
       version: process.env.npm_package_version || '1.0.0',
+      // Git SHA injected at build time by deploy.sh (Dockerfile ARG) — identifies
+      // the running build; null in local dev where no deploy stamp exists.
+      deployVersion: process.env.DEPLOY_VERSION || null,
       environment: process.env.NODE_ENV || 'development',
     };