Point email links at conchecker.scoutitsystems.com and show build SHA in header.

APP_BASE_URL default (config, .env.example, both compose files) is now
https://conchecker.scoutitsystems.com with no port, so review-required
and final-report email links use the public site. CI bakes the short
commit SHA into the image as APP_BUILD via a Docker build-arg; /health
returns version+build and the site header shows the build so it's easy
to confirm which image is deployed. Local runs default to 'dev'.

Dockerfile

@@ -19,6 +19,10 @@ COPY cli cli
 RUN mkdir -p backend/uploads backend/outputs backend/.llm_cache
 
 ENV PYTHONUNBUFFERED=1
+# Build identifier baked in by CI (sha-<short_sha>, matches the image tag);
+# defaults to "dev" for local builds. Surfaced in /health and the site header.
+ARG APP_BUILD=dev
+ENV APP_BUILD=${APP_BUILD}
 EXPOSE 8099
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \