Derive the version from the Cargo/pubspec manifests

The version string was duplicated across six places. Collapse it to two
ecosystem sources of truth and derive the rest:

- backend/src/web_server.rs: omit the OpenAPI info.version so utoipa fills
  it from CARGO_PKG_VERSION (backend/Cargo.toml); add a test pinning this.
- nix/package.nix: read the version from backend/Cargo.toml via fromTOML.
- nix/frontend.nix: read the version from frontend/pubspec.yaml by splitting
  into lines (a whole-file regex triggers catastrophic backtracking in Nix's
  regex engine).
- frontend/lib/about/about.dart: read the version at runtime via
  package_info_plus instead of a hardcoded constant.

Also drop frontend/pubspec.lock.json: it is unreferenced (Nix's
autoPubspecLock generates its own JSON from pubspec.lock) and was going stale.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/web_server.rs

@@ -40,7 +40,8 @@ pub mod utils;
 #[openapi(
     info(
         title = "OOTT API",
-        version = "0.1.0",
+        // version is intentionally omitted: utoipa fills it from the crate
+        // version (CARGO_PKG_VERSION, i.e. backend/Cargo.toml) automatically.
         description = "Network monitoring and alert system API"
     ),
     paths(
@@ -244,4 +245,12 @@ mod tests {
     fn web_root_falls_back_to_local_dir_without_an_executable() {
         assert_eq!(resolve_web_root(None), PathBuf::from("./web"));
     }
+
+    #[test]
+    fn openapi_version_tracks_the_crate_version() {
+        // The OpenAPI spec must report the crate version (backend/Cargo.toml)
+        // rather than a separately maintained literal.
+        let openapi = <ApiDoc as OpenApi>::openapi();
+        assert_eq!(openapi.info.version, env!("CARGO_PKG_VERSION"));
+    }
 }