Task #589: Live build stamp + server start time in System Updates panel

Problem: After `git pull && docker compose up -d --build api` on the
Mac, the admin → System Updates panel kept showing the same version
(0.1.0-dev) and the same build (20260517.b5efd9eb) because both come
from version.json, a hand-edited file that nothing rewrites on every
build. No visible signal that a new image was actually running.

Two independent signals were added — neither needs editing version.json
by hand:

1) Auto-stamp version.json at Docker build time
   - docker/api-server.Dockerfile: new ARGs GIT_SHA and BUILD_DATE.
     A `node -e` step rewrites version.json's `build` field to
     `${YYYYMMDDTHHmm}.${sha}` (e.g. 20260518T1042.a34eb5f5). When
     the args are missing/"unknown", version.json is left untouched
     so plain `docker build` and Replit `pnpm dev` still work.
   - docker-compose.yml: api.build.args wires through GIT_SHA and
     BUILD_DATE with `${GIT_SHA:-unknown}` fallbacks.
   - scripts/redeploy.sh: exports GIT_SHA (git rev-parse --short HEAD)
     and BUILD_DATE (date -u +%Y-%m-%dT%H:%M:%SZ) before `docker
     compose build`, so the helper script just works.

2) startedAt timestamp from the API
   - artifacts/api-server/src/routes/system.ts: SERVER_STARTED_AT
     captured at module load (frozen for the process lifetime) and
     added to every branch of GET /system/version (not-configured,
     error, invalid-version, up-to-date, update-available, catch).
   - lib/api-spec/openapi.yaml: added `startedAt: date-time` to
     SystemVersionResponse (required). Regenerated api-client-react
     and api-zod via `pnpm --filter @workspace/api-spec run codegen`.

3) Admin UI surfacing both signals
   - artifacts/tx-os/src/pages/admin.tsx: new formatBuildStamp parses
     `YYYYMMDD[THHmm].sha` and renders a localized date next to the
     raw token. A new "Server started" line below the build number
     formats the boot timestamp via the existing formatChecked helper.
   - artifacts/tx-os/src/locales/{en,ar}.json: added
     admin.systemUpdates.serverStartedAt ("Server started" /
     "بدأ تشغيل الخادم").

4) Docs
   - replit.md: documented how to verify a real redeploy via the
     System Updates panel and the manual one-liner for `docker
     compose build` without the helper script.

Verified: codegen succeeds, API workflow restarted clean, Vite served
fine. Pre-existing typecheck errors in push.ts and font-settings are
unrelated and untouched.

Mac next steps:
  cd ~/Downloads/TX && git pull && ./scripts/redeploy.sh
Then open admin → System Updates: build line should show a new
`YYYYMMDDTHHmm.sha` stamp and "Server started" should reflect the
new boot time.

artifacts/tx-os/src/locales/ar.json

@@ -556,6 +556,7 @@
       "checkNow": "تحقّق الآن",
       "loading": "جاري التحقق من الإصدار…",
       "lastChecked": "آخر تحقق",
+      "serverStartedAt": "بدأ تشغيل الخادم",
       "toastErrorTitle": "تعذّر التحقق",
       "toastErrorDesc": "لم نتمكن من الوصول إلى مصدر التحديثات. حاول مرة أخرى لاحقاً."
     },

artifacts/tx-os/src/locales/en.json

@@ -532,6 +532,7 @@
       "checkNow": "Check Now",
       "loading": "Checking version…",
       "lastChecked": "Last checked",
+      "serverStartedAt": "Server started",
       "toastErrorTitle": "Check failed",
       "toastErrorDesc": "Could not reach the update source. Please try again later."
     },

artifacts/tx-os/src/pages/admin.tsx

@@ -2381,6 +2381,31 @@ function SystemUpdatesPanel() {
     }).format(d);
   };
 
+  // The Docker build step stamps `build` as `YYYYMMDDTHHmm.shortsha`
+  // (e.g. `20260518T1042.a34eb5f5`). When the value matches that
+  // pattern, render a localized date/time next to the raw token so a
+  // non-technical user can see at a glance when the image was built.
+  // Older / hand-edited values (e.g. `20260517.b5efd9eb`) still render
+  // with date-only when possible, otherwise we just show the raw text.
+  const formatBuildStamp = (build: string | undefined) => {
+    if (!build) return null;
+    const m = build.match(
+      /^(\d{4})(\d{2})(\d{2})(?:T(\d{2})(\d{2}))?\.[A-Fa-f0-9]+$/,
+    );
+    if (!m) return null;
+    const [, y, mo, da, hh, mm] = m;
+    const iso =
+      hh && mm
+        ? `${y}-${mo}-${da}T${hh}:${mm}:00Z`
+        : `${y}-${mo}-${da}T00:00:00Z`;
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime())) return null;
+    return new Intl.DateTimeFormat(i18n.language === "ar" ? "ar" : "en", {
+      dateStyle: "medium",
+      ...(hh && mm ? { timeStyle: "short" } : {}),
+    }).format(d);
+  };
+
   const renderStatusBadge = (resp: SystemVersionResponse | undefined) => {
     if (!resp) return null;
     const map: Record<
@@ -2474,7 +2499,25 @@ function SystemUpdatesPanel() {
                 <span className="tabular-nums" data-testid="system-updates-current-build">
                   {data.current.build}
                 </span>
+                {formatBuildStamp(data.current.build) && (
+                  <span className="ms-2 text-muted-foreground/80">
+                    ({formatBuildStamp(data.current.build)})
+                  </span>
+                )}
               </div>
+              {data.startedAt && (
+                <div
+                  className="text-xs text-muted-foreground mt-1"
+                  data-testid="system-updates-started-at"
+                >
+                  {t("admin.systemUpdates.serverStartedAt")}:{" "}
+                  {formatChecked(
+                    typeof data.startedAt === "string"
+                      ? data.startedAt
+                      : (data.startedAt as Date).toISOString(),
+                  )}
+                </div>
+              )}
             </div>
 
             <div className="rounded-xl border border-slate-200 p-4 bg-slate-50/60">