Release v3.5.3 - Version source of truth refactor

What's Changed

Version management refactor

• GitHub release tag is now the single source of truth for app version
• Deleted .version file and scripts/sync-version.sh — no more manual version bumping
• App reads version from APP_VERSION env var (injected at Docker build time from release tag)
• package.json is auto-synced from the release tag during CI
• Local/dev runs show "dev" as the version

CI improvements (from v3.5.1)

• Added Codacy Security Scan workflow with SARIF integration
• Added PMD ruleset and .codacy.yml repo configuration
• Added least-privilege permissions to Docker build workflow jobs (CodeQL fix)
• Added ESLint 8 legacy config for Codacy CLI compatibility
• Excluded binary files from Codacy analysis to prevent CLI crashes
• Upgraded codeql-action/upload-sarif to v4

Code quality fixes (from v3.5.1)

• Removed unused imports and variables
• Replaced bare except/pass with debug logging
• Fixed object injection sink in api.js formatSize()

Full Changelog: v3.5.1...v3.5.3