version: every surface can say which build it is, and two of them were lying

Note 3127 §5 removed version tags, so an artifact's self-report is now the only
answer to "which build is this?" — and nothing exists to contradict it when it
is wrong. Three surfaces gain a dim build line: the foot of the web rail, the
login screen, and the foot of Sync on Android.

The login screen because "I can't sign in" is a bug report like any other, and
requiring an account to read a build number withholds it from exactly the people
who can't get past that page. `/api/config` is already public.

Two of the values it was going to show were wrong, which is the part worth
knowing about.

The DESKTOP reported `env!("CARGO_PKG_VERSION")` from `config_get` and from the
startup log. `cargo tauri build --config '{"version": ...}'` overrides
tauri.conf.json, not Cargo's own metadata — so both read the literal `0.2.0` in
Cargo.toml, on every build ever shipped. They now read a display version baked in
by the lane through `option_env!`, hoisted to the crate root because two readers
of one fact is how this repo keeps producing 2181-2183. Not the ordering key
either: `1.0.<minutes>` is the opaque value Tauri's updater compares and must
never be shown to a person, and `update.rs` still reads it because a comparator
is exactly what it is (rule 149).

The SERVER fell back to `__version__` when APP_VERSION was absent, so a server
run from a checkout reported `0.2.0` — a real-looking version naming no build
anybody could obtain. `__init__.py` already asserted the honest answer was
"APP_VERSION being missing, which app.py already handles"; it did not, and a
comment claiming a behaviour two files away is how that stayed true-sounding.
Now an explicit "unknown", with the packaging version left where "unknown" is
not a legal value.

Android reads the INSTALLED package's versionName rather than BuildConfig, so it
reports what is actually on the phone.

Everything renders "unknown" rather than blank when it cannot say. A blank looks
like a layout bug; a plausible default cannot be caught by anything.

build.rs gets `rerun-if-env-changed` for the baked value: cargo does not track an
`option_env!` variable on its own, and the desktop lane having no cache today is
what makes that easy to forget the day one is added.

tests/test_app.py

@@ -27,3 +27,50 @@ async def test_unknown_api_route_404s(app):
     client = app.test_client()
     resp = await client.get("/api/does-not-exist")
     assert resp.status_code == 404
+
+
+# --- the version a running server reports ------------------------------------
+#
+# Note 3127 §5 removed version tags, so this string is the only answer to "which
+# build is this?" and nothing exists to contradict it when it is wrong. That makes
+# the FALLBACK the interesting case rather than the happy path: it used to be
+# `__version__`, so a server run from a checkout reported `0.2.0` — a real-looking
+# version naming no build anybody could obtain.
+
+
+async def reported_version() -> str:
+    """What a freshly built app tells /api/health it is.
+
+    Built per call rather than through the `app` fixture: the value is read from the
+    environment in `create_app`, so an app constructed before `monkeypatch` ran would
+    answer about the wrong environment.
+    """
+    client = create_app().test_client()
+    return (await (await client.get("/api/health")).get_json())["version"]
+
+
+async def test_the_version_is_whatever_the_environment_says(monkeypatch):
+    monkeypatch.setenv("APP_VERSION", "2026.08.29.0443")
+    assert await reported_version() == "2026.08.29.0443"
+
+
+async def test_no_version_in_the_environment_reports_unknown(monkeypatch):
+    """The honest "I cannot say", not a plausible default.
+
+    Also asserted against `__version__` by name rather than against the literal it
+    happens to hold, so bumping the packaging version cannot make this pass for the
+    wrong reason.
+    """
+    from thoughtsync import __version__
+
+    monkeypatch.delenv("APP_VERSION", raising=False)
+    reported = await reported_version()
+    assert reported == "unknown"
+    assert reported != __version__
+
+
+async def test_an_empty_version_reports_unknown_too(monkeypatch):
+    """`APP_VERSION=` is what a mis-set build arg looks like, and an empty string
+    renders as a blank space rather than as a missing value."""
+    monkeypatch.setenv("APP_VERSION", "")
+    assert await reported_version() == "unknown"