Fix wrapped-course false positive in picker; add build version display

Sort Unsorted's destination picker still listed a course whose real
video content sat two levels deep inside its own "display name"
folder (a common release-bundle extraction shape), alongside empty
leftover folders from the extraction that neither of the two earlier
exclusion checks could safely rule out - an empty folder is
indistinguishable from a legitimate freshly-created category. Detect
this case by comparing token similarity between a folder's own name
and its single course child's name: high overlap means they're naming
the same thing (a redundant wrapper), not a deliberate category
holding one course.

Also bake the build's git commit + build time into the Docker image
(git rev-parse at build time, .git deleted again immediately after) so
a push's effect on the running container is actually visible - shown
on the Settings page and in /health - instead of having to guess
whether a webhook rebuild picked up the latest commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.dockerignore

@@ -1,5 +1,8 @@
 # Version control
-.git
+# .git is intentionally NOT excluded - the Dockerfile reads it at build
+# time (git rev-parse) to bake the running commit into the image as
+# /app/BUILD_VERSION, then deletes .git itself in that same build step so
+# it never ends up in the final image.
 .gitignore
 .github