SPEC v0.34: L-10 implemented (D-156), W0b recorded, web version code in the image build

- AC-3.2, E-16 (§14.3.4), §11.4: the "to implement" notes removed; D-156 says
  implemented in 07c36d2; security review L-10 note: fixed in 07c36d2. ctutils
  0.4.4 (RUSTSEC-2026-0385) in the v0.34 row. Server tests 300, contracts-check 136.
- §15.3: W0b as built (5305f37): shared pieces, no cross-feature imports or web_
  keys, per-locale amount fields, Recharts chunk, Vitest cache off, version code.
  Web gate 609 tests.
- server/Dockerfile: ARG KVITT_VERSION_CODE=1 in the Node stage, passed to
  npm run build; the Gitea workflow computes git rev-list --count HEAD and passes
  it as a build argument (§10.3).
- HANDOFF: main 5305f37 pushed 2026-10-24; next image build, deploy, laptop login,
  browser checks; Web follow-ups closed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

.gitea/workflows/build-images.yaml

@@ -96,6 +96,10 @@ jobs:
           fi
           echo "Version: $VERSION"
           echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          # The web's version code: the commit count, as the app's release builds count (fetch-depth 0 above).
+          VERSION_CODE=$(git rev-list --count HEAD)
+          echo "Version code: $VERSION_CODE"
+          echo "VERSION_CODE=$VERSION_CODE" >> "$GITHUB_ENV"
       # --provenance=false on every build: one plain linux/arm64 manifest per tag, as Podman and infra/build-images.sh
       # push. Without it buildx pushes an index with an attestation entry (platform unknown/unknown), which the Gitea
       # package page lists as an extra platform; nothing here reads attestations.
@@ -117,6 +121,7 @@ jobs:
             --platform linux/arm64 \
             --provenance=false \
             --build-arg CARGO_BUILD_JOBS=1 \
+            --build-arg "KVITT_VERSION_CODE=$VERSION_CODE" \
             -f ./server/Dockerfile \
             -t "$REGISTRY/kvitt-server:$VERSION" \
             -t "$REGISTRY/kvitt-server:latest" \