feat(web): show git SHA in footer for post-deploy verification

Dockerfile takes SOURCE_COMMIT as a build arg and bakes it into the
image as GIT_COMMIT. Coolify sets SOURCE_COMMIT on every deploy, so
the value in the footer changes with each successful push → build.

ARG is placed after COPY . so only a thin final layer rebuilds when
the SHA changes; pip install stays cached. Outside Coolify the
default is "dev" and the footer renders "build dev".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/common.py

@@ -23,7 +23,7 @@ import db
 import notifications
 from apply_client import ApplyClient, _row_to_profile
 from auth import issue_csrf_token
-from settings import APPLY_FAILURE_THRESHOLD, INTERNAL_API_KEY
+from settings import APPLY_FAILURE_THRESHOLD, GIT_COMMIT, INTERNAL_API_KEY
 
 
 logger = logging.getLogger("web")
@@ -114,6 +114,8 @@ def base_context(request: Request, user, active_tab: str) -> dict:
         "csrf": issue_csrf_token(user["id"]),
         "active_tab": active_tab,
         "is_admin": bool(user["is_admin"]),
+        "git_commit": GIT_COMMIT,
+        "git_commit_short": GIT_COMMIT[:7] if GIT_COMMIT and GIT_COMMIT != "dev" else GIT_COMMIT,
     }