feat: expose the built commit SHA in /health

Redeploying AppSail is a separate manual step from pushing to main, and
whether a given fix is actually live has been genuinely ambiguous multiple
times tonight -- deployment timestamps alone don't say which commit they
pulled. The CI image build now bakes the commit SHA in as a build arg;
/health reports it as git_sha so a redeploy can be confirmed by comparing
it against the latest commit on main, instead of guessing from timing.

Author: SarmaHighOnCode

.github/workflows/ci.yml

@@ -91,6 +91,8 @@ jobs:
           context: ./backend
           push: true
           platforms: linux/amd64
+          build-args: |
+            GIT_SHA=${{ github.sha }}
           tags: |
             ghcr.io/sarmahighoncode/kaval-api:latest
             ghcr.io/sarmahighoncode/kaval-api:${{ github.sha }}

backend/Dockerfile

@@ -1,5 +1,10 @@
 FROM python:3.12-slim
 WORKDIR /srv/backend
+# Bakes the built commit into the image so /health can report exactly what's
+# running -- redeploying is a separate manual step from pushing to main, and
+# "is my fix actually live" has cost real debugging time more than once.
+ARG GIT_SHA=unknown
+ENV KAVAL_GIT_SHA=$GIT_SHA
 COPY requirements.txt requirements-catalyst.txt ./
 RUN pip install --no-cache-dir -r requirements.txt \
     # --no-deps: zcatalyst-sdk pins typing-extensions~=4.12.1, which conflicts

backend/app/main.py

@@ -203,4 +203,7 @@ def health() -> dict:
         "zcql_connected": zcql_ok,
         "smartbrowz_enabled": smartbrowz,
         "voice_endpoints": ["/api/voice/stt", "/api/voice/tts"],
+        # Baked in at Docker build time (see Dockerfile's GIT_SHA build arg) --
+        # "unknown" means this image predates that change, not that it failed.
+        "git_sha": __import__("os").environ.get("KAVAL_GIT_SHA", "unknown"),
     }