chore: derive version from git tags via hatch-vcs

Replace hardcoded version in pyproject.toml with hatch-vcs so the
package version is read from git tags at build time. Dockerfile
accepts a VERSION build arg and passes it as HATCH_VCS_PRETEND_VERSION
for builds without a git checkout. Makefile _tag target now rebuilds
the container with the correct version automatically.

Dockerfile

@@ -32,7 +32,8 @@ COPY --chown=appuser:appuser pyproject.toml uv.lock README.md ./
 
 # Switch to appuser and install Python dependencies
 USER appuser
-RUN uv sync --frozen
+ARG VERSION=dev
+RUN HATCH_VCS_PRETEND_VERSION=${VERSION} uv sync --frozen
 
 # Copy application source
 COPY --chown=appuser:appuser src/ ./src/