docs: show each environment's live API version

[aditeyabaral]

📌 Description

Nothing in the README said which version was deployed, or anywhere to see that production and
staging differ. Two badges now read info.version directly from each environment's
/openapi.json — public, unauthenticated, 18 KB.

They are self-updating: no release step has to remember to edit the README, and the two
disagreeing is precisely how you notice production is behind. That happened twice this week — prod
sat on 4.1.0 against dev's 4.2.0, then on 4.2.0 against 4.4.0 — and both times it had to be found
by hand. As of this PR the badges read production v4.4.0 against staging v4.5.0, so the drift
is visible rather than discovered.

ℹ️ Fixes / Related Issues
Related: #160, which added the rest of the monitoring links.

🧱 Type of Change

• 🐛 Bug fix – Non-breaking fix for a functional/logic error
• ✨ New feature – Adds functionality without breaking existing APIs
• ⚠️ Breaking change – Introduces backward-incompatible changes (API, schema, etc.)
• 📝 Documentation update – README, docstrings, OpenAPI tags, etc.
• 🧪 Test suite change – Adds/updates unit, functional, or integration tests
• ⚙️ CI/CD pipeline update – Modifies GitHub Actions, pre-commit, or Docker build
• 🧹 Code quality / Refactor – Improves structure, readability, or style (no functional changes)
• 🐢 Performance improvement – Speeds up auth, scraping, or reduces I/O
• 🕵️ Debug/logging enhancement – Adds or improves logging/debug support
• 🔧 Developer tooling – Scripts, benchmarks, local testing improvements
• 🔒 Security fix – Addresses auth/session/data validation vulnerabilities
• 🧰 Dependency update – Updates libraries in requirements.txt, pyproject.toml

🧪 How Has This Been Tested?

• Unit Tests (tests/unit/)
• Functional Tests (tests/functional/)
• Integration Tests (tests/integration/)
• Manual Testing

276 tests, 100.00% coverage, unchanged — no code is touched. pre-commit run --all-files
passes 12/12 hooks.

Manual: both badge URLs fetched and confirmed to render real SVGs reading production: v4.4.0 and
staging: v4.5.0, matching what each /openapi.json reports.

⚙️ Test Configuration:

• OS: Linux
• Python: 3.14.4 via uv
• Docker build tested

Unchecked: nothing in the image or its behaviour changes.

✅ Checklist

• My code follows the CONTRIBUTING.md guidelines
• I've performed a self-review of my changes
• I've added/updated necessary comments and docstrings
• I've updated relevant docs (README or endpoint docs)
• No new warnings introduced
• I've added tests to cover my changes
• All tests pass locally (scripts/run_tests.py)
• I've run linting and formatting (pre-commit run --all-files)
• Docker image builds and runs correctly
• Changes are backwards compatible (if applicable)
• Feature flags or .env vars updated (if applicable)
• I've tested across multiple environments (if applicable)
• Benchmarks still meet expected performance (scripts/benchmark/benchmark_requests.py)

Unchecked items carry no work: no code, no image change, no new variables, nothing a benchmark
measures.

🛠️ Affected API Behaviour

• app/app.py – Modified /authenticate route logic
• app/pesu.py – Updated scraping or authentication handling

Only README.md.

🧩 Models

• app/models/request.py – Input validation or request schema changes
• app/models/response.py – Authentication response formatting
• app/models/profile.py – Profile extraction logic

🐳 DevOps & Config

• Dockerfile – Changes to base image or build process
• .github/workflows/*.yaml – CI/CD pipeline or deployment updates
• pyproject.toml / requirements.txt – Dependency version changes
• .pre-commit-config.yaml – Linting or formatting hook changes

Project version only, 4.5.0 → 4.6.0, plus the matching uv.lock. No dependency changes.

📊 Benchmarks & Analysis

• scripts/benchmark/benchmark_requests.py – Performance or latency measurement changes
• scripts/benchmark/analyze_benchmark.py – Benchmark result analysis changes
• scripts/run_tests.py – Custom test runner logic or behavior updates

🧠 Additional Notes

A GitHub release badge was the obvious alternative and would have been actively wrong. The
newest release is v2.1, tagged July 2025 — two major versions behind the 4.5.0 the API serves.
Worth fixing separately: the releases page is public and currently misleads.

/metrics cannot serve this, even though it would be the natural home. It carries no version
metric, and it now requires a bearer token that shields.io cannot send. /openapi.json is the only
public surface exposing the version, which is why the badges point there. A
pesu_auth_build_info{version} gauge would fix the metrics side and let the Grafana dashboard
correlate a deploy with a change in behaviour — currently it can only show that a restart happened.

cacheSeconds=600 keeps shields from re-fetching on every README view. It also means a badge
can lag a deploy by up to ten minutes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VU7YUhP71KSsotWQ1H7CRH