feat: expose deploy version (git SHA) on CMS and health endpoint

'Is the fix live?' becomes a single check instead of an SSH session:

- CMS: git short SHA read at startup, shown in the bottom bar (v<sha>),
  served by the public GET /version endpoint, recorded in a startup audit
  entry
- Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it
  via build ARG into the runtime env, /api/health reports it as
  deployVersion, smoke test asserts a non-'unversioned' stamp

Closes MITHOME-63

proto/e2e/staging-smoke.spec.ts

@@ -4,7 +4,11 @@ test('SMOKE-01: health endpoint is available', async ({ request }) => {
   const response = await request.get('/api/health')
   expect(response.status()).toBe(200)
   await expect(response).toBeOK()
+  const body = await response.json()
   await expect(response.json()).resolves.toMatchObject({ status: 'ok' })
+  // The deployed build must carry a git SHA stamp (deploy.sh injects it).
+  expect(typeof body.deployVersion).toBe('string')
+  expect(body.deployVersion).not.toBe('unversioned')
 })
 
 test('SMOKE-02: homepage renders its critical shell without console errors', async ({ page }) => {