feat(server,web): expose server version via /healthz + display in Settings

Came up debugging the in-app update flow — wasn't obvious which image
the container was actually running without exec'ing in. New flow:

### Server
- internal/server/version.go: new `var ServerVersion = "dev"`,
  overridden via -ldflags at build time.
- /healthz response gains a "version" key alongside the existing
  "status" + "min_client_version". Backward-compat: existing clients
  ignore unknown JSON fields. Endpoint stays unauthenticated.

### Build
- Dockerfile: new `ARG MINSTREL_VERSION=dev`, threaded into the
  go build -ldflags so the binary's ServerVersion is stamped at
  link time. Default "dev" preserves local `docker build` ergonomics.
- .forgejo/workflows/release.yml: tags step also emits a `version`
  output (the git tag for tag pushes, "main" for branch pushes);
  build step passes it as `--build-arg MINSTREL_VERSION=...`.

### Web
- web/src/lib/components/ServerVersion.svelte: small understated
  text ("Server v2026.05.10.2") that fetches /healthz on mount.
  Renders nothing on parse failure or pre-version images.
- Mounted at the bottom of Settings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/server/server.go

@@ -148,6 +148,7 @@ func (s *Server) handleHealthz(w http.ResponseWriter, _ *http.Request) {
 	w.WriteHeader(http.StatusOK)
 	_ = json.NewEncoder(w).Encode(map[string]string{
 		"status":             "ok",
+		"version":            ServerVersion,
 		"min_client_version": MinClientVersion,
 	})
 }

internal/server/version.go

@@ -4,3 +4,13 @@ package server
 // accepts. Bump it when a server change requires a paired client update;
 // older clients see version_too_old at /healthz and refuse to operate.
 const MinClientVersion = "0.1.0"
+
+// ServerVersion is the deployed server image's version tag. Defaults to
+// "dev" for local builds; overridden at link time via:
+//
+//   -ldflags="-X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerVersion=v2026.05.10.2'"
+//
+// release.yml passes the git tag through MINSTREL_VERSION build-arg →
+// Dockerfile ldflag. Surfaced at /healthz so operators can verify which
+// image their container is running without exec'ing into it.
+var ServerVersion = "dev"