feat(api): /VERSION single source read at startup + GET /version

api/app/version.py

@@ -0,0 +1,33 @@
+"""Single source of truth for the app version (charter §4: client and API share
+one version). Reads the repo-root /VERSION file — the ONLY place a human edits the
+version. Mirrors canon_log._schema_dir's env-override + walk-up so it resolves in
+a local checkout and (once /VERSION is bundled) an image alike.
+"""
+import os
+from functools import lru_cache
+from pathlib import Path
+
+LAST_RESORT = "0.0.0-dev"
+
+
+def _version_file() -> Path | None:
+    env = os.environ.get("COC_VERSION_FILE")
+    if env:
+        return Path(env)
+    here = Path(__file__).resolve()
+    for parent in here.parents:
+        candidate = parent / "VERSION"
+        if candidate.is_file():
+            return candidate
+    return None
+
+
+@lru_cache(maxsize=1)
+def get_version() -> str:
+    path = _version_file()
+    if path is None or not path.is_file():
+        return LAST_RESORT
+    return path.read_text(encoding="utf-8").strip() or LAST_RESORT
+
+
+VERSION = get_version()