Serve /version.json on the API host

[dmccoystephenson]

Summary

GET /version.json is added to the API host (play.<base>). It answers {"version": "<arcade.__version__>"} with Content-Type: application/json and Cache-Control: no-store, needs no token, and lets a deploy be verified by the version it reports.

The route is deliberately limited to the API host. On a game's host (<slug>.play.<base> or an alias) /version.json remains the game's own path, so a static game that ships a version.json is still served it and nothing is shadowed. Unknown hosts, the internal host and tak game hosts answer 404 as before.

Changes

• src/arcade/server.py: _version() on the API host.
• tests/test_server.py: status, content type, cache header and body == arcade.__version__ (GET and HEAD); a static game's own /version.json still served on its host; 404 on tak game, alias, unknown and bare hosts.
• README API table and CHANGELOG (Unreleased).

Verification

• python -m pytest: 129 passed.
• Local server (python3 -m arcade serve with the example registry):

$ curl -i -H 'Host: play.danielstephenson.dev' http://127.0.0.1:18080/version.json
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 20
Cache-Control: no-store
...
{"version": "0.6.0"}

The same path with Host: tidewater.play.danielstephenson.dev answered 404. The Docker image was not built locally (no Docker in the sandbox); the CI docker job covers it.

---

drafted by Claude on behalf of Daniel Stephenson

🤖 Generated with Claude Code