ci(release): stage version.json into backend build context (drift fix)

The backend Docker image is built with `context: ./backend`, so the
repo-root `version.json` is outside the build context and never
reaches the container. Backend `main.py` falls back to a compile-
time `_version_info` constant when `/app/version.json` is missing.

In practice this produced a real production drift: a successful
redeploy of the v1.5.2 tree silently reported `"v1.5.0"` in
`/api/version` for a window of releases because the constant in
main.py had not been bumped in lockstep with `version.json`, and
the canonical file was never available to read inside the
container.

Fix is workflow-only:
  * New "stage version.json into backend build context" step
    (between `read product version` and `set up qemu`) that runs
    `cp version.json backend/version.json` so the next
    `docker buildx build` includes it.
  * `.gitignore` entry for `backend/version.json` keeps `git status`
    clean for developers (the canonical file remains at repo root;
    `backend/version.json` is a transient CI artefact).

Backend reading logic is unchanged: the loop in `main.py` first
tries `/app/version.json`, then falls back to the constant.
Post-fix, the first path WILL find the file and produce the
correct response; the constant becomes a pure defensive fallback
(rather than the production hot path it accidentally became).

No code or test changes needed: existing tests assert against the
`_version_info` dict regardless of whether it was populated from
JSON or the fallback constant.

.github/workflows/docker-build.yml

@@ -26,6 +26,20 @@ jobs:
           fi
           echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
 
+      # The backend image is built with `context: ./backend`, so the
+      # repo-root version.json is OUTSIDE the build context and never
+      # reaches the container. Backend `main.py` falls back to a
+      # compile-time constant when /app/version.json is missing, which
+      # caused a real production drift: a redeploy of the v1.5.2 tree
+      # silently still reported "v1.5.0" in `/api/version` because the
+      # constant in main.py had been bumped but the file was not
+      # available to read. Stage version.json into the backend
+      # context here so the canonical file IS shipped and the
+      # constant only serves as a defensive fallback. The staged file
+      # is gitignored to keep `git status` clean for developers.
+      - name: stage version.json into backend build context
+        run: cp version.json backend/version.json
+
       - name: set up qemu
         uses: docker/setup-qemu-action@v3
 

.gitignore

@@ -42,6 +42,11 @@ venv.bak/
 # Docker
 .dockerignore
 
+# Build-time staged version.json (CI `cp version.json backend/`).
+# The canonical file lives at repo root; this path is a transient
+# copy for the backend Docker build context.
+backend/version.json
+
 # IDE
 .vscode/
 .idea/