fix(client): take the reported version as one anchored match before storing it

The dev branch gate on SonarCloud has been red since the 4.3.0 cycle on this
one line: the version from /api/config is written to localStorage, and the
taint engine did not read the replace() plus equality check as sanitisation
(S8475). The value is the match of ^[\w.+-]{1,64}$ now, the same characters
and length as before, in the shape the engine recognises.

client/src/App.tsx

@@ -320,14 +320,13 @@ export default function App() {
       if (config?.permissions) usePermissionsStore.getState().setPermissions(config.permissions)
 
       // A version is a short release tag and nothing else. It arrives over the
-      // wire and is written to this device's storage, so it is rebuilt from the
-      // characters a tag may contain and kept only when nothing had to be
-      // stripped. Anything else is ignored, which also keeps a malformed value
-      // from being compared against the stored marker and starting an update on
-      // every launch.
-      const reportedVersion = typeof config?.version === 'string' ? config.version : ''
-      const version = reportedVersion.replace(/[^\w.+-]/g, '').slice(0, 64)
-      if (version && version === reportedVersion) {
+      // wire and is written to this device's storage, so only a value made of
+      // the characters a tag may contain is taken, as the match itself. Anything
+      // else is ignored, which also keeps a malformed value from being compared
+      // against the stored marker and starting an update on every launch.
+      const releaseTag = /^[\w.+-]{1,64}$/.exec(typeof config?.version === 'string' ? config.version : '')
+      if (releaseTag) {
+        const version = releaseTag[0]
         const storedVersion = localStorage.getItem('trek_app_version')
         // Record the version BEFORE acting on it. The old code wrote the marker
         // after the purge and outside its try, so a throwing setItem (private