Fix commit hash not showing in Docker builds (#43)

* Fix commit hash not showing in Docker builds

build_info.js computed buildHash via `git rev-parse --short HEAD` at
runtime, but the final image intentionally has no git binary and no
.git directory (kept lean, per .dockerignore) — so this always failed
silently and the footer's version line showed "unknown" for every
Docker deployment. Working correctly only for bare-metal/dev, where
git + .git are actually present.

Added a throwaway gitinfo build stage that reuses the main base image
(no extra pull) with git installed just for this stage, reads .git
from the build context (now no longer excluded — see .dockerignore),
and bakes the resolved short hash into a small file that IS copied
into the final image. build_info.js reads that file first, falling
back to the old git-rev-parse behavior (still needed for bare-metal).

Verified against a real build: `docker exec sso-manager cat
/app/.build_commit` matches `git rev-parse --short HEAD` on the host,
and the footer now shows the real hash instead of "unknown". Same fix
already applied to proxy (theta42/proxy#133).

* Support GIT_COMMIT build-arg override for submodule builds

The gitinfo stage from the previous commit works for a standalone
clone (.git is a real directory) but not when this repo is built as a
git submodule (e.g. from theta-env): a submodule's .git is a pointer
FILE, not a directory — the real object database lives in the
superproject's .git/modules/, outside this repo's own directory and
therefore outside Docker's build context entirely. `git rev-parse`
can never resolve it from in here no matter what, so builds via
theta-env still baked in "unknown" despite the earlier fix.

Add an optional GIT_COMMIT build-arg that, when set, wins over the
in-context git resolution. theta-env's setup.sh now computes it on the
host (where the submodule DOES resolve correctly) and passes it via
docker-compose.yml's build.args. Same fix in proxy: theta42/proxy#133.

Verified via theta-env's actual setup.sh end to end: rebuilding with
this change, `docker exec sso-manager cat /app/.build_commit` now
matches `git -C sso-manager-node rev-parse --short HEAD` on the host
(previously: "unknown").

nodejs/utils/build_info.js

@@ -1,15 +1,29 @@
 'use strict';
 
+const fs = require('fs');
+const path = require('path');
 const { execSync } = require('child_process');
 const { version: buildVersion } = require('../package.json');
 
-let buildHash = 'unknown';
-try {
-	buildHash = execSync('git rev-parse --short HEAD', { cwd: __dirname }).toString().trim();
-} catch (_) {}
+// Docker builds bake the commit hash into ../.build_commit (see the gitinfo
+// stage in Dockerfile.openldap) -- the final image has no git binary and no
+// .git directory, so `git rev-parse` below always fails there. Bare-metal/dev
+// runs have no baked file, so they fall back to asking git directly.
+function readBuildHash() {
+	try {
+		const baked = fs.readFileSync(path.join(__dirname, '../.build_commit'), 'utf8').trim();
+		if (baked) return baked;
+	} catch (_) {}
+
+	try {
+		return execSync('git rev-parse --short HEAD', { cwd: __dirname }).toString().trim();
+	} catch (_) {
+		return 'unknown';
+	}
+}
 
 module.exports = {
 	buildVersion,
-	buildHash,
+	buildHash: readBuildHash(),
 	buildYear: new Date().getFullYear(),
 };