fix(web): read git SHA from .git in the image instead of SOURCE_COMMIT

Coolify v4 doesn't inject SOURCE_COMMIT (only COOLIFY_BRANCH,
COOLIFY_FQDN, COOLIFY_RESOURCE_UUID, COOLIFY_URL and the container
name). The previous build-arg approach always resolved to "dev".

Switch the web build context to the repo root so the Dockerfile can
COPY .git into a scratch path, parse HEAD → SHA with a small sh
snippet (handles both detached-HEAD and packed-refs), and stamp the
image with a /git_commit file. settings.py now prefers env GIT_COMMIT
(for local dev overrides) and falls back to /git_commit → "dev".

The .git copy is the last content layer, so only this thin layer
invalidates per commit; pip install stays cached.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -1,9 +1,10 @@
 services:
   web:
     build:
-      context: ./web
-      args:
-        SOURCE_COMMIT: ${SOURCE_COMMIT:-dev}
+      # Context is the repo root so the Dockerfile can read .git for the
+      # SHA stamp — Coolify doesn't expose the commit as an env var.
+      context: .
+      dockerfile: web/Dockerfile
     container_name: lazyflat-web
     restart: unless-stopped
     depends_on: