feat(release): version stamping and tag-triggered release workflow

--version/-V on the CLI, version in /api/health via Server.SetVersion,
Makefile/Dockerfile ldflags stamping from git describe, and a release
workflow on v* tags: both binaries for linux/darwin (amd64+arm64) and
windows/amd64 with SHA256SUMS attached to the Gitea release
(idempotent — reuses an existing hand-written release and skips
already-uploaded assets), plus version-tagged Docker images.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/api/server.go

@@ -27,14 +27,23 @@ var staticFiles embed.FS
 
 // Server is the HTTP API server.
 type Server struct {
-	addr   string
-	srv    *http.Server
-	cancel context.CancelFunc
+	addr    string
+	version string
+	srv     *http.Server
+	cancel  context.CancelFunc
 }
 
 // NewServer creates a new Server that listens on addr (e.g. ":8080").
 func NewServer(addr string) *Server {
-	return &Server{addr: addr}
+	return &Server{addr: addr, version: "dev"}
+}
+
+// SetVersion records the build version reported by GET /api/health.
+// Call before Start; empty values are ignored.
+func (s *Server) SetVersion(v string) {
+	if v != "" {
+		s.version = v
+	}
 }
 
 // Start builds the HTTP handler, begins listening, and returns when the
@@ -44,6 +53,7 @@ func (s *Server) Start() error {
 	ctx, cancel := context.WithCancel(context.Background())
 	s.cancel = cancel
 	h := newHandler(ctx)
+	h.version = s.version
 
 	sub, err := fs.Sub(staticFiles, "static")
 	if err != nil {