SPEC v0.34: L-10 implemented (D-156), W0b recorded, web version code in the image build

- AC-3.2, E-16 (§14.3.4), §11.4: the "to implement" notes removed; D-156 says
  implemented in 07c36d2; security review L-10 note: fixed in 07c36d2. ctutils
  0.4.4 (RUSTSEC-2026-0385) in the v0.34 row. Server tests 300, contracts-check 136.
- §15.3: W0b as built (5305f37): shared pieces, no cross-feature imports or web_
  keys, per-locale amount fields, Recharts chunk, Vitest cache off, version code.
  Web gate 609 tests.
- server/Dockerfile: ARG KVITT_VERSION_CODE=1 in the Node stage, passed to
  npm run build; the Gitea workflow computes git rev-list --count HEAD and passes
  it as a build argument (§10.3).
- HANDOFF: main 5305f37 pushed 2026-10-24; next image build, deploy, laptop login,
  browser checks; Web follow-ups closed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/Dockerfile

@@ -20,7 +20,10 @@ COPY web/package.json web/package-lock.json ./
 RUN --mount=type=cache,target=/root/.npm npm ci
 COPY contracts/ /repo/contracts/
 COPY web/ ./
-RUN npm run build && test -f dist/index.html
+# The web's version code (X-Kvitt-App-Version): the Node stage has no .git, so the build reads it from
+# KVITT_VERSION_CODE (vite.config.ts); the Gitea workflow passes git rev-list --count HEAD. Default 1.
+ARG KVITT_VERSION_CODE=1
+RUN KVITT_VERSION_CODE="$KVITT_VERSION_CODE" npm run build && test -f dist/index.html
 
 # ---- stage 2: server build -------------------------------------------------------------------------------------
 FROM docker.io/library/rust:1.99.1-bookworm AS build