fix(health): report configured application version

/health read the APP_VERSION environment variable directly, but
docker-compose passes App__Version, which binds to the App:Version
configuration key. The variable under that name never existed in the
container, so the endpoint always reported "unknown".

Read App:Version through IConfiguration, the approach AdminSystemController
already used for the same value. The resolution rule (configured version,
else assembly version) moves to a shared BuildMetadata helper rather than
being written twice; AdminSystemController now calls it, so the admin page
and /health cannot drift apart.

Local development is unaffected: nothing sets App:Version there, and the
assembly-version fallback still applies.

Tests pin the configuration KEY, not just the behaviour, including that an
App__Version environment variable binds to App:Version. The original bug
failed silently, so a behavioural test alone would not have caught it.

Verified against a running backend: App__Version=9.9.9-test reports
9.9.9-test; unset reports the assembly version rather than "unknown".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

JobTrackerApi/Program.cs

@@ -525,10 +525,13 @@ app.MapControllers();
 // that queried MariaDB would restart a perfectly healthy backend whenever the database blipped, and
 // would also be a free unauthenticated way to probe database availability.
 // docs/production-readiness-review.md.
-app.MapGet("/health", () => Results.Ok(new
+// Version comes from configuration (App:Version), which is how docker-compose supplies it as
+// App__Version. Reading the APP_VERSION environment variable directly meant /health always
+// reported "unknown" in a container. Falls back to the assembly version for local development.
+app.MapGet("/health", (IConfiguration cfg) => Results.Ok(new
 {
     status = "ok",
-    version = Environment.GetEnvironmentVariable("APP_VERSION") ?? "unknown",
+    version = BuildMetadata.ResolveVersion(cfg),
 })).AllowAnonymous();
 
 // API schema for tooling/docs. Dev-only: not exposed in production deployments.