feat: add JSON /version/ build-info endpoint (#1366)

[jonfroehlich]

Closes #1366.

What

Adds an unauthenticated, machine-readable build-info endpoint so we can confirm what code a server is actually running without fetching a full page and scraping the <!-- Makeability Lab website version ... --> comment in base.html. This is option (b) Full from the issue.

GET /version/        (also /version.json)
{
  "version": "2.17.0",
  "description": "Add an unauthenticated machine-readable build/version endpoint ...",
  "environment": "PROD",
  "git_sha": "29cc8b6",
  "built_at": "2026-06-22T18:30:00-07:00"
}

How

• website/views/version.py — version() view. version/description/environment come from settings.py; git_sha/built_at are read from a build-info file (falls back to "unknown" if absent, e.g. local dev). Sets Cache-Control: no-store so Apache/any proxy can't serve a stale version string. No per-request git shell-out.
• docker-entrypoint.sh — one early step writes build-info.json from git rev-parse --short HEAD + date --iso-8601=seconds at container start. The servers deploy via git so .git is present; gracefully falls back to "unknown" if git is unavailable. This means git isn't needed in the runtime image.
• website/urls.py — routes /version/ and /version.json to the view.
• .gitignore — ignores the per-deploy build-info.json.
• Bump ML_WEBSITE_VERSION → 2.17.0.

Design notes

• No new info disclosure for version/description — both already public via the HTML comment. git_sha + built_at are what actually answer "is prod stale?" — a bumped tag that never deployed shows an old SHA/timestamp at a glance.
• A natural /healthz-style building block if we later want uptime/version monitoring.

Tests

• New website/tests/test_version_endpoint.py (6 tests): routing for both URLs, payload-from-settings, no-store header, build-info read from file, and the missing-file "unknown" fallback. All pass; smoke/view suites still green.
• Verified live locally: curl /version/ and /version.json both return the JSON with Cache-Control: no-store; the entrypoint snippet produces real values in-container.

Not a UI change, so no screenshots / Pa11y run needed.

🤖 Generated with Claude Code