feat: add build argument for PACA_VERSION in Dockerfile and CD workflow

[pikann]

Summary

• API reads its running version from the PACA_VERSION env var (defaults to dev), used by /api/version to power the "new version available" banner — but nothing set it, so self-hosted images always reported dev.
• Add ARG PACA_VERSION=dev / ENV PACA_VERSION=$PACA_VERSION to services/api/Dockerfile so the value is baked into the image at build time.
• Pass PACA_VERSION=${{ github.event.release.tag_name }} as a build-arg in the api-image job of cd.yml, so each published GitHub Release stamps its image with the matching tag (e.g. v1.2.3).

Test plan

• docker build --build-arg PACA_VERSION=v9.9.9-test . → container reports PACA_VERSION=v9.9.9-test
• docker build . (no build-arg, as in local/dev) → container reports PACA_VERSION=dev

[pullfrog]

✅ No new issues found.

Reviewed changes — wires the existing PACA_VERSION env var into the Docker build and CD pipeline so release images report their correct version tag.

• Add ARG PACA_VERSION=dev / ENV PACA_VERSION=$PACA_VERSION to services/api/Dockerfile — placed in the runtime stage (not build), since the version is read at startup rather than linked at compile time.
• Pass PACA_VERSION=${{ github.event.release.tag_name }} in cd.yml — the api-image job already runs only on release: published, so the tag is always defined.

  ^{｜ View workflow run ｜ Using DeepSeek Pro (free via Pullfrog for OSS) (Kimi K2 not used — the program covers this model; add its provider key to run your pick) ｜ 𝕏}