Forward build provenance args to local compose builds

[SiteRelEnby]

Closes the one gap in build provenance. GET /v1/version reports the commit/tag/build-time the backend was built from - useful for confirming which commit a deployed instance is actually running.

The Dockerfile already consumes GIT_COMMIT / GIT_TAG / BUILD_TIME into SHEAF_* env, and ci.yml passes them on every ghcr image build, so the official images already carry provenance. The gap was a local docker compose build: the app service's args block forwarded INCLUDE_DEV_TOOLS and the pip-mirror vars but not the git ones, so a compose-built image reported null commit/tag/time.

The app service now forwards GIT_COMMIT / GIT_TAG / BUILD_TIME from the host environment (compose can't run git itself; the host populates them). SELFHOSTING.md documents the one-liner:

GIT_COMMIT=$(git rev-parse --short HEAD) \
GIT_TAG=$(git describe --tags --always) \
BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
docker compose up --build -d app

Unset values stay empty, so nothing changes for anyone who doesn't opt in. Verified the env-to-arg substitution with docker compose config; the arg-to-ENV-to-/v1/version chain is unchanged from what CI already exercises.

Docs/infra only - no Python, no migration.