fix(docker): take the version from the image, not from the container's env

Portainer's recreate and a copied run config carry the previous image's
APP_VERSION into a container built from the new one, so the server kept
announcing the old release and clients never handed over to the new
bundle. The Dockerfile now writes the version into server/VERSION, which
the server reads before APP_VERSION, and prerelease bundles take their
version from the same build argument.

server/src/app-config/derive.ts

@@ -29,6 +29,7 @@ import {
   resolveSessionTtlMs,
   stripTrailingSlashes,
 } from './parsers';
+import { imageVersion } from './image-version';
 
 export type RawEnv = Record<string, string | undefined>;
 
@@ -43,8 +44,13 @@ export function deriveApp(raw: RawEnv) {
     isTest: nodeEnv === 'test',
     port: numberOr(raw.PORT, 3001),
     host: raw.HOST,
-    /** Raw APP_VERSION — fallbacks differ per site ('0.0.0' vs package.json vs semver-validated); each keeps its own. */
-    appVersion: raw.APP_VERSION,
+    /**
+     * The image's own VERSION file, else raw APP_VERSION. Fallbacks differ per
+     * site ('0.0.0' vs package.json vs semver-validated); each keeps its own.
+     * The file wins because a container keeps its env across image updates
+     * (image-version.ts).
+     */
+    appVersion: imageVersion() ?? raw.APP_VERSION,
     /** Raw APP_URL — trailing-slash stripping differs per site (feeds strips one, notifications strips all). */
     appUrl: raw.APP_URL,
     tz: raw.TZ,

server/src/app-config/image-version.ts

@@ -0,0 +1,33 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+/**
+ * The version the Docker image was built as, from the `VERSION` file the
+ * Dockerfile writes next to `server/package.json`.
+ *
+ * It wins over the APP_VERSION env var because an env var belongs to the
+ * container, not to the image. Portainer's "recreate" and `docker run` with a
+ * copied config carry the previous image's APP_VERSION into a container built
+ * from the new one, so the server kept announcing the old release and no client
+ * ever handed over to the new bundle. A file inside the image cannot outlive it.
+ *
+ * Read once: the file is part of the image and does not change while the
+ * process runs. `null` outside an image (source checkout, tests), where the env
+ * var and package.json keep deciding as before.
+ */
+let cached: string | null | undefined;
+
+export function imageVersion(file = resolve(__dirname, '../../VERSION')): string | null {
+  if (cached !== undefined) return cached;
+  try {
+    cached = readFileSync(file, 'utf8').trim() || null;
+  } catch {
+    cached = null;
+  }
+  return cached;
+}
+
+/** Test seam: forget the cached read. */
+export function resetImageVersion(): void {
+  cached = undefined;
+}