fix(version): sync package.json to v0.41.0 + guard against future drift

package.json said 0.40.0 while HISTORY.md's shipped release was v0.41.0, so
/api/version, the release-notes badge (has_new_version), and the update
checker all reported the wrong version. tests/versionSync.test.js now fails
the suite whenever the two drift again.

(QA-B0-03)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "bill-tracker",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Monthly bill tracking system",
   "main": "server.cts",
   "engines": {

tests/versionSync.test.js

@@ -0,0 +1,26 @@
+'use strict';
+
+// QA-B0-03 — package.json is the single source of truth for the app version
+// (/api/version, the release-notes badge, updateCheckService all read it), and
+// HISTORY.md's top heading is the release record. They drifted once (0.40.0 vs
+// v0.41.0); this guard makes the drift a test failure instead of a silent lie.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+test('package.json version matches the top HISTORY.md release heading', () => {
+  const pkg = require('../package.json');
+  const history = fs.readFileSync(path.join(__dirname, '..', 'HISTORY.md'), 'utf8');
+
+  const match = history.match(/^## v(\d+\.\d+(?:\.\d+)?)/m);
+  assert.ok(match, 'HISTORY.md has a "## vX.Y[.Z]" release heading');
+
+  // Normalize: HISTORY sometimes uses two-part versions (v0.41) for a series.
+  const historyVersion = match[1];
+  const pkgVersion = pkg.version;
+  assert.ok(
+    pkgVersion === historyVersion || pkgVersion.startsWith(`${historyVersion}.`),
+    `package.json version (${pkgVersion}) must match the top HISTORY.md heading (v${historyVersion})`,
+  );
+});