feat(fase-14): version chip in /settings + GIT_SHA bake-through (14.3)

`apps/web/vite.config.ts` now injects three build-time constants via
`define`: `__APP_VERSION__` (root package.json), `__APP_COMMIT__`
(GIT_SHA env > local `git rev-parse` > 'dev'), `__BUILD_TIME__` (ISO
timestamp at build). They're declared in `apps/web/src/global.d.ts`
and re-exported through `$lib/version` — components consume the named
exports rather than the magic globals so an accidental tree-shake
would break the test, not the page silently.

`/settings` gains an "About" section at the bottom: a small chip
`v{version} · {commit} · {date}` in muted text. Not interactive,
purely diagnostic — useful when a user reports a bug from a stale
PWA install.

Deploy pipeline:
  - `apps/web/Dockerfile` accepts a `GIT_SHA` build arg and exports
    it as an env var for the SvelteKit build step.
  - `infra/docker-compose.erosi.yml` forwards `${GIT_SHA:-dev}` into
    the build args.
  - `infra/scripts/deploy-erosi.sh` captures `git rev-parse --short
    HEAD` locally (the deploy host has .git; the remote doesn't —
    rsync excludes it) and forwards it via `ssh ... env GIT_SHA=…`
    so the remote `docker compose build` sees it.

V-01/V-02 vitest: stub the three globals via `vi.stubGlobal` (vitest
doesn't run through the main vite.config so `define` isn't applied),
assert the named exports thread through and never collapse to
undefined or the 'dev' sentinel under a real build.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/web/src/routes/(app)/settings/+page.svelte

@@ -30,6 +30,7 @@
 		PUBLIC_KEYCLOAK_URL,
 		PUBLIC_KEYCLOAK_REALM
 	} from '$env/static/public';
+	import { version, commit, builtAt } from '$lib/version';
 
 	// Profile state loaded from public.users
 	let displayNameInput = $state('');
@@ -607,6 +608,17 @@
 				</button>
 			</section>
 
+			<!-- About (Fase 14.3.4) — version / commit / build-time chip.
+			     Not clickable, just informational. -->
+			<section class="pt-8" data-testid="settings-about">
+				<p class="mb-2 text-[13px] font-semibold uppercase tracking-[0.05em] text-text-secondary">
+					{m.settings_about()}
+				</p>
+				<p class="text-xs text-text-secondary" data-testid="settings-about-version">
+					{m.settings_about_version({ version, commit, date: builtAt.slice(0, 10) })}
+				</p>
+			</section>
+
 			<!-- Danger zone (Fase 10.5) -->
 			<section class="pt-8">
 				<p class="mb-3 text-[13px] font-semibold uppercase tracking-[0.05em] text-destructive">