feat(podcasts+ops): Apple launcher-scheme feeds + visible build stamp

Apple scheme normalization (follow-up to the Scribl discussion): Add
Feed accepts the launcher spellings podcast pages ship next to plain
RSS — itpc://, podcasts://, feed:// — and rewrites them to the https
feed URL they wrap (scheme match case-insensitive). http stays and the
guard still rejects it. Unit-pinned.

Build stamp (stale-container drift guard): the 2026-10-29 podcast
session lost an hour to a container running a build that predated the
feature. version.Commit rides ldflags from a GIT_COMMIT build arg; the
dev compose passes git rev-parse --short HEAD via the Makefile; the
app logs 'Bookhoard <ver> (commit <hash>)' at boot and /api/health
reports it — the UI and the repo can no longer silently diverge.

internal/router/frontend.go

@@ -1984,6 +1984,7 @@ func (cfg *Config) GetHealth(c *echo.Context) error {
 	return c.JSON(http.StatusOK, map[string]interface{}{
 		"status":   "healthy",
 		"version":  version.Version,
+		"commit":   version.Commit,
 		"database": "connected",
 		"scan": map[string]interface{}{
 			"scan_in_progress": cfg.Worker.HasActiveScans(),

internal/services/podcast_rss_test.go

@@ -290,3 +290,14 @@ func newInsecureFeedServer(t *testing.T, body string) *httptest.Server {
 	t.Cleanup(srv.Close)
 	return srv
 }
+
+// Apple Podcast launcher schemes normalize to the https feed they wrap.
+func TestNormalizeFeedURL(t *testing.T) {
+	assert.Equal(t, "https://x.test/feed.xml", normalizeFeedURL("itpc://x.test/feed.xml"))
+	assert.Equal(t, "https://x.test/feed.xml", normalizeFeedURL("podcasts://x.test/feed.xml"))
+	assert.Equal(t, "https://x.test/feed.xml", normalizeFeedURL("feed://x.test/feed.xml"))
+	assert.Equal(t, "https://x.test/feed.xml", normalizeFeedURL("ITPC://x.test/feed.xml"), "scheme match is case-insensitive")
+	assert.Equal(t, "https://x.test/feed.xml", normalizeFeedURL("https://x.test/feed.xml"))
+	assert.Equal(t, "http://x.test/feed.xml", normalizeFeedURL("http://x.test/feed.xml"), "http stays — the guard rejects it downstream")
+	assert.Equal(t, "", normalizeFeedURL("   "))
+}

internal/services/podcast_service.go

@@ -156,7 +156,7 @@ func (s *PodcastService) AddFeed(ctx context.Context, userID pgtype.UUID, isAdmi
 		}
 	}
 
-	feedURL := strings.TrimSpace(rawFeedURL)
+	feedURL := normalizeFeedURL(rawFeedURL)
 	if feedURL == "" {
 		return nil, errBadRequest("feed URL is required")
 	}
@@ -711,6 +711,23 @@ func sortedStringSet(set map[string]bool) []string {
 
 // classifyFetchError maps guard/HTTP errors to user-facing text (the
 // add-feed dialog and the download_error column both render it).
+// normalizeFeedURL accepts the launcher-scheme spellings podcast
+// pages hand out alongside plain RSS (issue follow-up: "one says RSS,
+// the other says Apple Podcast") and rewrites them to the https URL
+// they wrap: itpc:// and podcasts:// are Apple's subscribe-launcher
+// aliases for the SAME feed document; feed:// is the generic form.
+// Anything else keeps its scheme — guardFetch enforces https.
+func normalizeFeedURL(raw string) string {
+	u := strings.TrimSpace(raw)
+	lowered := strings.ToLower(u)
+	for _, prefix := range []string{"itpc://", "podcasts://", "feed://"} {
+		if strings.HasPrefix(lowered, prefix) {
+			return "https://" + u[len(prefix):]
+		}
+	}
+	return u
+}
+
 func classifyFetchError(err error) error {
 	if errors.Is(err, ErrBlockedPrivateAddress) {
 		return fmt.Errorf("blocked: private/loopback addresses are not fetchable")

internal/version/version.go

@@ -8,3 +8,11 @@ package version
 // The release workflow passes the git tag (e.g. v1.5) as the APP_VERSION
 // Docker build arg, which the Dockerfile forwards to this flag.
 var Version = "dev"
+
+// Commit is the git commit the binary was built from (short hash),
+// injected alongside Version via ldflags (GIT_COMMIT build arg). It
+// exists so "the UI I'm looking at" vs "the code in the repo" drift is
+// VISIBLE — the 2026-10-29 podcast debugging session burned an hour on
+// a stale container that predated the feature. "none" for unstampeded
+// local builds.
+var Commit = "none"