healthz: version always reports 'unknown' in production (Dockerfile launches node directly, not npm)

[CryptoJones]

Problem

GET /healthz reports the running version from process.env.npm_package_version:

// app/controllers/healthcontroller.js:86
version: process.env.npm_package_version || 'unknown',

npm_package_version is only set when the process is launched via an npm script (e.g. npm start). The repo Dockerfile (line 80) launches via:

CMD ["node", "server.js"]

— no npm wrapper. So in every Docker / Kubernetes / systemd deployment, process.env.npm_package_version is undefined and the probe falls back to version: "unknown". Operators trying to verify a rolling deploy ("is the new pod at v1.2.3 yet?") get no signal.

Proposed fix

Read version from package.json once at module load:

const path = require('node:path');
let PACKAGE_VERSION = 'unknown';
try {
    PACKAGE_VERSION = require(path.resolve(__dirname, '../../package.json')).version
        || PACKAGE_VERSION;
} catch (_err) {
    // package.json missing/malformed — keep fallback so /healthz still serves
}

Wrap in try/catch so a broken install (package.json missing) can't take /healthz down — the endpoint is operationally critical and must come up even on a broken install. Pin behavior with a test asserting body.version === pkg.version.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/