Task #589: Live build stamp + server start time in System Updates panel

Problem: After `git pull && docker compose up -d --build api` on the
Mac, the admin → System Updates panel kept showing the same version
(0.1.0-dev) and the same build (20260517.b5efd9eb) because both come
from version.json, a hand-edited file that nothing rewrites on every
build. No visible signal that a new image was actually running.

Two independent signals were added — neither needs editing version.json
by hand:

1) Auto-stamp version.json at Docker build time
   - docker/api-server.Dockerfile: new ARGs GIT_SHA and BUILD_DATE.
     A `node -e` step rewrites version.json's `build` field to
     `${YYYYMMDDTHHmm}.${sha}` (e.g. 20260518T1042.a34eb5f5). When
     the args are missing/"unknown", version.json is left untouched
     so plain `docker build` and Replit `pnpm dev` still work.
   - docker-compose.yml: api.build.args wires through GIT_SHA and
     BUILD_DATE with `${GIT_SHA:-unknown}` fallbacks.
   - scripts/redeploy.sh: exports GIT_SHA (git rev-parse --short HEAD)
     and BUILD_DATE (date -u +%Y-%m-%dT%H:%M:%SZ) before `docker
     compose build`, so the helper script just works.

2) startedAt timestamp from the API
   - artifacts/api-server/src/routes/system.ts: SERVER_STARTED_AT
     captured at module load (frozen for the process lifetime) and
     added to every branch of GET /system/version (not-configured,
     error, invalid-version, up-to-date, update-available, catch).
   - lib/api-spec/openapi.yaml: added `startedAt: date-time` to
     SystemVersionResponse (required). Regenerated api-client-react
     and api-zod via `pnpm --filter @workspace/api-spec run codegen`.

3) Admin UI surfacing both signals
   - artifacts/tx-os/src/pages/admin.tsx: new formatBuildStamp parses
     `YYYYMMDD[THHmm].sha` and renders a localized date next to the
     raw token. A new "Server started" line below the build number
     formats the boot timestamp via the existing formatChecked helper.
   - artifacts/tx-os/src/locales/{en,ar}.json: added
     admin.systemUpdates.serverStartedAt ("Server started" /
     "بدأ تشغيل الخادم").

4) Docs
   - replit.md: documented how to verify a real redeploy via the
     System Updates panel and the manual one-liner for `docker
     compose build` without the helper script.

Verified: codegen succeeds, API workflow restarted clean, Vite served
fine. Pre-existing typecheck errors in push.ts and font-settings are
unrelated and untouched.

Mac next steps:
  cd ~/Downloads/TX && git pull && ./scripts/redeploy.sh
Then open admin → System Updates: build line should show a new
`YYYYMMDDTHHmm.sha` stamp and "Server started" should reflect the
new boot time.

docker/api-server.Dockerfile

@@ -32,11 +32,23 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm install --frozen-lockfile --ignore-scripts
 
 FROM deps AS build
+# Build-time stamp. Pass these from `docker compose build` so the
+# admin "System Updates" panel can show *which* code is running, not
+# just whatever is hard-coded in version.json. When the args are not
+# provided (e.g. someone running `docker build` by hand), we leave
+# version.json untouched.
+ARG GIT_SHA=""
+ARG BUILD_DATE=""
 COPY tsconfig.base.json* tsconfig.json* ./
 COPY version.json ./
 COPY lib lib
 COPY scripts scripts
 COPY artifacts/api-server artifacts/api-server
+RUN if [ -n "$GIT_SHA" ] && [ -n "$BUILD_DATE" ] && [ "$GIT_SHA" != "unknown" ] && [ "$BUILD_DATE" != "unknown" ]; then \
+      GIT_SHA="$GIT_SHA" BUILD_DATE="$BUILD_DATE" node -e "const fs=require('fs');const p='./version.json';const v=JSON.parse(fs.readFileSync(p,'utf8'));const d=String(process.env.BUILD_DATE||'').replace(/[-:]/g,'').replace(/\..*$/,'').slice(0,13);v.build=(d||'unknownDate')+'.'+(process.env.GIT_SHA||'unknownSha');fs.writeFileSync(p,JSON.stringify(v,null,2)+'\n');console.log('Stamped build:',v.build);" ; \
+    else \
+      echo "No GIT_SHA/BUILD_DATE provided — keeping version.json as-is" ; \
+    fi
 RUN pnpm --filter @workspace/api-server run build
 
 FROM base AS runtime