version: every surface can say which build it is, and two of them were lying

Note 3127 §5 removed version tags, so an artifact's self-report is now the only
answer to "which build is this?" — and nothing exists to contradict it when it
is wrong. Three surfaces gain a dim build line: the foot of the web rail, the
login screen, and the foot of Sync on Android.

The login screen because "I can't sign in" is a bug report like any other, and
requiring an account to read a build number withholds it from exactly the people
who can't get past that page. `/api/config` is already public.

Two of the values it was going to show were wrong, which is the part worth
knowing about.

The DESKTOP reported `env!("CARGO_PKG_VERSION")` from `config_get` and from the
startup log. `cargo tauri build --config '{"version": ...}'` overrides
tauri.conf.json, not Cargo's own metadata — so both read the literal `0.2.0` in
Cargo.toml, on every build ever shipped. They now read a display version baked in
by the lane through `option_env!`, hoisted to the crate root because two readers
of one fact is how this repo keeps producing 2181-2183. Not the ordering key
either: `1.0.<minutes>` is the opaque value Tauri's updater compares and must
never be shown to a person, and `update.rs` still reads it because a comparator
is exactly what it is (rule 149).

The SERVER fell back to `__version__` when APP_VERSION was absent, so a server
run from a checkout reported `0.2.0` — a real-looking version naming no build
anybody could obtain. `__init__.py` already asserted the honest answer was
"APP_VERSION being missing, which app.py already handles"; it did not, and a
comment claiming a behaviour two files away is how that stayed true-sounding.
Now an explicit "unknown", with the packaging version left where "unknown" is
not a legal value.

Android reads the INSTALLED package's versionName rather than BuildConfig, so it
reports what is actually on the phone.

Everything renders "unknown" rather than blank when it cannot say. A blank looks
like a layout bug; a plausible default cannot be caught by anything.

build.rs gets `rerun-if-env-changed` for the baked value: cargo does not track an
`option_env!` variable on its own, and the desktop lane having no cache today is
what makes that easy to forget the day one is added.

frontend/src/components/AppShell.vue

@@ -27,6 +27,23 @@ const ui = useUiStore();
 // Sync is a desktop-app concern: the web build already IS the server's UI.
 const desktopApp = isDesktop();
 
+// The build, for the dim line at the foot of the rail (#3181).
+//
+// NEVER BLANK. "unknown" is the honest answer when the value is missing, and an
+// empty space is a bug that reads as a design choice. Note 3127 §5: with version
+// tags gone this is the only answer to "which build is this?", so it has to be
+// either right or visibly absent.
+//
+// One slot, two artifacts, and that is deliberate rather than sloppy. In the
+// browser `repo` is `rest`, so this is the SERVER's version; in the desktop shell
+// `repo` is `local` and `config_get` returns the desktop build's own. Each surface
+// names the thing the person is actually looking at. A linked server's version is
+// a different question and Sync answers it separately.
+const buildVersion = computed(() => config.version || "unknown");
+const buildLabel = computed(
+  () => `ThoughtSync ${desktopApp ? "desktop" : "server"} build ${buildVersion.value}`,
+);
+
 async function removeView(f: SavedFilter) {
   if (!window.confirm(`Delete the "${f.name}" view?`)) return;
   try {
@@ -415,7 +432,7 @@ async function signOut() {
         @click="drawer = false"
       ></div>
       <aside
-        class="fixed inset-y-0 left-0 z-40 w-64 -translate-x-full overflow-y-auto border-r border-neutral-200 bg-neutral-50 p-3 pb-[calc(0.75rem+env(safe-area-inset-bottom,0px))] pt-[calc(0.75rem+env(safe-area-inset-top,0px))] transition-transform duration-200 sm:static sm:z-auto sm:w-56 sm:translate-x-0 sm:pb-3 sm:pt-3 dark:border-neutral-800 dark:bg-neutral-950"
+        class="fixed inset-y-0 left-0 z-40 flex w-64 -translate-x-full flex-col overflow-y-auto border-r border-neutral-200 bg-neutral-50 p-3 pb-[calc(0.75rem+env(safe-area-inset-bottom,0px))] pt-[calc(0.75rem+env(safe-area-inset-top,0px))] transition-transform duration-200 sm:static sm:z-auto sm:w-56 sm:translate-x-0 sm:pb-3 sm:pt-3 dark:border-neutral-800 dark:bg-neutral-950"
         :class="drawer ? 'translate-x-0' : ''"
       >
         <nav class="flex flex-col gap-0.5 text-sm" @click="drawer = false">
@@ -527,6 +544,17 @@ async function signOut() {
             </button>
           </div>
         </nav>
+
+        <!-- The build. `mt-auto` puts it at the foot of the rail when the nav is
+             short and lets it simply follow when the nav has scrolled.
+             `select-all` because the one thing anybody does with this is copy it
+             into a bug report. -->
+        <p
+          class="mt-auto select-all px-3 pt-6 text-[11px] text-neutral-400 dark:text-neutral-500"
+          :title="buildLabel"
+        >
+          {{ buildVersion }}
+        </p>
       </aside>
 
       <!-- tabindex="-1" so the skip link above actually moves FOCUS here, not just

frontend/src/views/LoginView.vue

@@ -88,6 +88,18 @@ async function submit() {
           >Create one</RouterLink
         >
       </p>
+
+      <!-- The build, on the one screen a person can reach WITHOUT an account.
+           "I can't sign in" is a bug report like any other and it needs a build
+           number; requiring a login to read one would withhold it from exactly the
+           people who cannot get past this page. `/api/config` is public, so this
+           costs nothing that was not already public (#3181). -->
+      <p
+        class="mt-8 select-all text-center text-[11px] text-neutral-400 dark:text-neutral-500"
+        :title="`ThoughtSync server build ${config.version || 'unknown'}`"
+      >
+        {{ config.version || "unknown" }}
+      </p>
     </div>
   </main>
 </template>