fix(updater): stop false-positive "update available" loop when commit is unknown

Dockerfile never received DASHCADDY_COMMIT at build, so /app/VERSION held
'unknown'. _isNewer then treated same-version-different-commit as newer,
making the auto-updater rebuild the container indefinitely (each rebuild
still produced commit='unknown').

- self-updater._isNewer: normalize commits; treat unknown/null/empty as no
  commit info and fall back to pure version comparison
- self-updater._autoCheckAndApply + routes/updates: refuse to apply when
  local version >= remote version (belt-and-suspenders)
- update-management.js: hide '(unknown)' from version label
- Dockerfile: COPY VERSION instead of writing from build arg
- VERSION: committed placeholder ('dev'); scripts/release.sh now writes
  the real short SHA into the tarball's VERSION before tar-ing, so every
  published release ships with an accurate commit

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashcaddy-api/routes/updates.js

@@ -95,6 +95,15 @@ module.exports = function({ updateManager, selfUpdater, asyncHandler, logError }
     if (!check.available) {
       return res.json({ success: true, message: 'Already up to date' });
     }
+    // Refuse same-version applies. The check.available flag can theoretically be
+    // true with equal versions (commit-mismatch path); applying anyway just
+    // rebuilds the container without changing anything user-visible and pollutes
+    // history with v1.4.0 → v1.4.0 entries.
+    const localV = check.local && check.local.version;
+    const remoteV = check.remote && check.remote.version;
+    if (localV && remoteV && localV === remoteV) {
+      return res.json({ success: true, message: 'Already up to date', version: localV });
+    }
     // Start async — container may restart
     selfUpdater.applyUpdate(check.remote).catch(err => {
       logError('self-update', err);
@@ -102,8 +111,8 @@ module.exports = function({ updateManager, selfUpdater, asyncHandler, logError }
     res.json({
       success: true,
       message: 'Update initiated',
-      fromVersion: check.local.version,
-      toVersion: check.remote.version,
+      fromVersion: localV,
+      toVersion: remoteV,
     });
   }, 'system-update-apply'));