[bifrost0x]

Fixes #327

Version display

• Signed-in users see the running version at the bottom of the account menu
  (on phones under More, then the user name) and, on wide screens, in the
  Settings side panel, e.g. 3.0.0 (917006e).
• The short commit comes from WEBSSH_REVISION, which the image sets from the
  existing VCS_REF build argument. Only a full 40-character commit id is shown;
  local builds without it show the release number alone.
• Sign-in and registration pages do not show the version, so it does not help
  fingerprint an instance from outside.
• The new ENV sits after the last RUN/COPY, so a new revision does not
  invalidate cached layers.

Release contract

• app/version.py holds the release number. A test requires it to match the
  newest file in docs/releases/, and the tag-triggered candidate build refuses
  a tag other than v<VERSION>. Release step documented in
  docs/project-planning.md; the upgrade guide lists the version check and a
  short FAQ entry.

Python base image

• Both build stages are pinned to the python:3.14-slim index digest for
  3.14.10-slim-trixie (amd64 and arm64 included).

Validation

• Full pytest suite on Python 3.14.10 in a Linux container: 4948 passed,
  21 skipped.
• JavaScript: vendor check, lint and 1069 unit tests passed; Playwright
  account-menu, theme-system and automation-navigation passed (11), the
  mobile account-menu test now also checks the version line.
• Image built with the new digest: /ready, gthread worker, recovery volume
  ownership and graceful stop passed; check_hardened_container.py passed for
  the compatible, hardened and hardened-custom profiles.
• Checked in the browser on desktop and phone width.
• Not run locally: Trivy and the arm64 build; both run in CI.