sanity-check.sh: add a Versions block for every involved service

Informational only, doesn't affect PASS/WARN/FAIL - lists apache/bind/
postfix/dovecot/rspamd/redis/mariadb/fail2ban/docker/certbot/php7.4/8.0
plus each Docker container's actual running version (not just its
image tag), queried from inside the container where the tag alone
doesn't say much.

README.md

@@ -63,6 +63,15 @@ lookups, fail2ban's jail count and the custom `findtime` hardening, all 7
 public vhosts by expected HTTP status code (plus a genuine Gitea API
 check, not just a static-page response), and all 6 Docker containers.
 
+Also prints a **Versions** block (added 2026-07-26, informational only —
+doesn't affect the PASS/WARN/FAIL count) listing what's actually running
+for every service above plus each Docker container's image tag and, where
+the image tag alone doesn't say much (`:latest`/`:apache`/`:lts`/`:alpine`),
+the real version queried from inside the running container itself
+(Portainer's own `/api/status`, Nextcloud's `occ status`, the actual
+`nginx`/`mariadb`/`redis-server` binaries, Gitea's API) — a quick reference
+after any upgrade without having to SSH in and check each service by hand.
+
 Runs automatically once per boot via `sanity-check.service` (a oneshot
 unit, `systemctl enable`d, `After=` all the relevant services plus a 10s
 settle delay before running) — covers OS upgrades, kernel updates, and