fix(web): read SOURCE_COMMIT directly, don't reference it in compose

Previous attempt mapped GIT_COMMIT=${SOURCE_COMMIT:-dev} in compose.
That backfired: Coolify parses the compose, sees ${SOURCE_COMMIT},
auto-registers it as a user-defined env var with my "dev" default,
and then *skips* its own SHA injection — because the registration
guard is "only inject if user hasn't defined it." Result: container
got SOURCE_COMMIT=dev and footer kept showing build dev.

Drop the compose reference entirely so Coolify's auto-injection
takes over, and read SOURCE_COMMIT in settings.py (with GIT_COMMIT
kept as the local-dev override). One-time cleanup of the orphan
SOURCE_COMMIT rows in the Coolify DB was done out-of-band.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -7,9 +7,10 @@ services:
       apply:
         condition: service_started
     environment:
-      # Coolify injects SOURCE_COMMIT at runtime on every deploy; settings.py
-      # reads GIT_COMMIT and renders it in the footer.
-      - GIT_COMMIT=${SOURCE_COMMIT:-dev}
+      # SOURCE_COMMIT is auto-injected by Coolify at runtime; settings.py
+      # reads it and renders it in the footer. Don't reference it here —
+      # Coolify treats any ${SOURCE_COMMIT} in the compose as a user env
+      # var and stops injecting the real SHA.
       - AUTH_USERNAME=${AUTH_USERNAME}
       - AUTH_PASSWORD_HASH=${AUTH_PASSWORD_HASH}
       - SESSION_SECRET=${SESSION_SECRET}