Show the deployed commit as a hover tooltip on the topbar brand

ASSET_VERSION only proves *a* deploy happened recently, not *which*
commit -- not enough to answer "did my push actually deploy, or am I
looking at a stale browser cache" (today's actual answer: neither --
deploy was current, a GeoJSON cache predating a code change was just
never invalidated, since it only checks the source .gpx's mtime).

The CI deploy job now writes REVISION (short SHA) before dropping
.git; app.rb reads it at boot, falling back to "dev" locally/in CI's
own check job where the file never exists.

app.rb

@@ -39,6 +39,20 @@ module Maptool
     # the container) is enough — it doesn't need to survive restarts.
     ASSET_VERSION = Time.now.to_i
 
+    # Written by the CI deploy job (.gitea/workflows/ci.yml) right before it
+    # drops .git from the deployed copy, so this is the only way to tell
+    # which commit is actually live short of asking the deploy job itself —
+    # handy for exactly the kind of "did my push actually deploy, or am I
+    # looking at a stale browser cache" confusion ASSET_VERSION above can't
+    # answer by itself (that only proves *a* deploy happened recently, not
+    # *which* one). Absent outside a real deploy (local dev, CI's own
+    # `check` job), hence the fallback.
+    REVISION = begin
+      File.read(File.join(__dir__, "REVISION")).strip
+    rescue Errno::ENOENT
+      "dev"
+    end
+
     # Overridable so the test suite can point this at a throwaway directory
     # instead of the real data/ — nothing else needs to set this.
     DATA_DIR = ENV.fetch("MAPTOOL_DATA_DIR") { File.join(__dir__, "data") }
@@ -151,7 +165,7 @@ module Maptool
     end
 
     get "/" do
-      erb :index, locals: { logged_in: logged_in?, user: session[:user] }
+      erb :index, locals: { logged_in: logged_in?, user: session[:user], revision: REVISION }
     end
 
     get "/api/health" do