feat(version): answer the build commit and time

GET /api/version is public. CI passes GIT_SHA and BUILD_TIME as Docker build args; a local build answers dev.

readme.md

@@ -56,6 +56,7 @@ To Be Played is split into three repositories:
 | `PUT` | `/api/users/settings/profile-stats` (`{groups}`: `PILE`, `TOP_GAMES`, `TASTE`, `HABITS`, `FINISHED`, `TREND`; `204`) | access token |
 | `GET` | `/api/public/profiles/{displayName}` | public |
 | `GET` | `/api/stats/public` | public |
+| `GET` | `/api/version` (`{commit, builtAt}` of the running image, from the CI build; `dev` locally) | public |
 
 Endpoints use Spring's API versioning with a query parameter: `?version=1.0` (default `1.0`).
 
@@ -80,6 +81,7 @@ layers:
 | Persistence | `persistence` | JPA entities, Spring Data repositories, `EntityMapper`. Entities never reach the API layer. |
 
 `profile` and `stats` only read data. They have no entities and use `JdbcTemplate` queries in a `repo` package.
+`version` has only an `api` package: `GET /api/version` answers the commit and build time of the running image.
 
 ArchUnit enforces these rules in `src/test/java/auth_service/architecture/ArchitectureTest.java`, so a layer
 violation fails the build. It also keeps the modules independent of each other and free of cycles. Test base