fix(web): read git SHA from .git in the image instead of SOURCE_COMMIT

Coolify v4 doesn't inject SOURCE_COMMIT (only COOLIFY_BRANCH,
COOLIFY_FQDN, COOLIFY_RESOURCE_UUID, COOLIFY_URL and the container
name). The previous build-arg approach always resolved to "dev".

Switch the web build context to the repo root so the Dockerfile can
COPY .git into a scratch path, parse HEAD → SHA with a small sh
snippet (handles both detached-HEAD and packed-refs), and stamp the
image with a /git_commit file. settings.py now prefers env GIT_COMMIT
(for local dev overrides) and falls back to /git_commit → "dev".

The .git copy is the last content layer, so only this thin layer
invalidates per commit; pip install stays cached.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/Dockerfile

@@ -3,17 +3,30 @@ FROM python:3.12-slim
 ENV PYTHONUNBUFFERED=1
 WORKDIR /app
 
-COPY requirements.txt .
+# Deps first so a code-only change doesn't bust the pip-install cache.
+COPY web/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
+# App code.
+COPY web/ .
 
-# Stamp the image with the git SHA so the web footer can show which commit is
-# live. Coolify passes SOURCE_COMMIT as a build arg on every deploy; outside
-# Coolify the ARG defaults to "dev". Placed after COPY so only this thin layer
-# rebuilds when the SHA changes — pip install stays cached.
-ARG SOURCE_COMMIT=dev
-ENV GIT_COMMIT=${SOURCE_COMMIT}
+# Stamp with the git SHA read from the build context's .git dir. Kept last so
+# only this thin layer invalidates per commit. Coolify doesn't expose the SHA
+# as an env/build-arg, but it does leave .git intact in the checkout — so we
+# parse HEAD ourselves. Build context must be the repo root for .git to be
+# visible (see docker-compose.yml).
+COPY .git /tmp/.git
+RUN set -eu; \
+    HEAD=$(cat /tmp/.git/HEAD 2>/dev/null || echo ""); \
+    case "$HEAD" in \
+      "ref: "*) REF=$(printf '%s' "$HEAD" | awk '{print $2}'); \
+                SHA=$(cat "/tmp/.git/$REF" 2>/dev/null || \
+                      awk -v r="$REF" '$2==r {print $1}' /tmp/.git/packed-refs 2>/dev/null || \
+                      echo "");; \
+      *) SHA="$HEAD";; \
+    esac; \
+    printf '%s\n' "${SHA:-dev}" > /git_commit; \
+    rm -rf /tmp/.git
 
 EXPOSE 8000