feat: expose build version in public config

- add version to public/admin config responses
- inject build version in Docker and GoReleaser builds
- limit Docker image publishing to v* tags
- restore soft-deleted settings on upsert

src/route/admin_router_test.go

@@ -322,6 +322,16 @@ func TestAdminInitPasswordFlow(t *testing.T) {
 	if fetchData["password"] != initPassword {
 		t.Fatalf("expected initial password %s, got %v", initPassword, fetchData["password"])
 	}
+	var plaintextRows int64
+	if err := dao.Mdb.Unscoped().
+		Model(&mdb.Setting{}).
+		Where("`key` = ?", mdb.SettingKeyInitAdminPasswordPlain).
+		Count(&plaintextRows).Error; err != nil {
+		t.Fatalf("count init password plaintext rows: %v", err)
+	}
+	if plaintextRows != 0 {
+		t.Fatalf("expected init password plaintext to be hard-deleted, got %d rows", plaintextRows)
+	}
 
 	recFetch2 := doGet(e, "/admin/api/v1/auth/init-password")
 	if recFetch2.Code != http.StatusBadRequest {
@@ -973,6 +983,58 @@ func TestAdminSettings_DeleteNonExistent(t *testing.T) {
 	}
 }
 
+func TestAdminSettings_DeleteThenReupsertRestoresSetting(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://rate.old.example", "type": "string"},
+		},
+	}, token)
+	assertOK(t, rec)
+
+	rec = doDeleteAdmin(e, "/admin/api/v1/settings/"+mdb.SettingKeyRateApiUrl, token)
+	assertOK(t, rec)
+	if got := data.GetSettingString(mdb.SettingKeyRateApiUrl, "fallback"); got != "fallback" {
+		t.Fatalf("deleted setting still in cache/read path: got %q", got)
+	}
+
+	rec = doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://rate.new.example", "type": "string"},
+		},
+	}, token)
+	assertOK(t, rec)
+
+	rec = doGetAdmin(e, "/admin/api/v1/settings?group=rate", token)
+	resp := assertOK(t, rec)
+	rows, ok := resp["data"].([]interface{})
+	if !ok {
+		t.Fatalf("expected settings array, got %T", resp["data"])
+	}
+	found := false
+	for _, row := range rows {
+		item, _ := row.(map[string]interface{})
+		if item["key"] == mdb.SettingKeyRateApiUrl {
+			found = true
+			if item["value"] != "https://rate.new.example" {
+				t.Fatalf("rate.api_url value = %v, want new value", item["value"])
+			}
+		}
+	}
+	if !found {
+		t.Fatalf("expected settings list to include restored %s", mdb.SettingKeyRateApiUrl)
+	}
+
+	var restored mdb.Setting
+	if err := dao.Mdb.Unscoped().Where("`key` = ?", mdb.SettingKeyRateApiUrl).Take(&restored).Error; err != nil {
+		t.Fatalf("load restored setting unscoped: %v", err)
+	}
+	if restored.DeletedAt.Valid {
+		t.Fatalf("restored setting still has deleted_at=%v", restored.DeletedAt)
+	}
+}
+
 func TestAdminConfig_ExposesOkPayCredentials(t *testing.T) {
 	e, token := setupAdminTestEnv(t)
 	if err := data.SetSetting(mdb.SettingGroupBrand, mdb.SettingKeyBrandCheckoutName, "admin cashier", mdb.SettingTypeString); err != nil {

src/route/router_test.go

@@ -484,6 +484,11 @@ func TestGetSupportedAssets_WalletAddressToggle(t *testing.T) {
 
 func TestGetPublicConfig(t *testing.T) {
 	e := setupTestEnv(t)
+	oldVersion := config.BuildVersion
+	config.BuildVersion = "v1.0.1"
+	t.Cleanup(func() {
+		config.BuildVersion = oldVersion
+	})
 	if err := data.SetSetting(mdb.SettingGroupBrand, mdb.SettingKeyBrandCheckoutName, "asd", mdb.SettingTypeString); err != nil {
 		t.Fatalf("seed brand.checkout_name: %v", err)
 	}
@@ -527,6 +532,9 @@ func TestGetPublicConfig(t *testing.T) {
 	if len(supports) < 2 {
 		t.Fatalf("expected >= 2 network supports, got %d", len(supports))
 	}
+	if respData["version"] != "v1.0.1" {
+		t.Fatalf("version = %v, want v1.0.1", respData["version"])
+	}
 	site, ok := respData["site"].(map[string]interface{})
 	if !ok {
 		t.Fatalf("expected site object, got %T", respData["site"])