Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@backend/build.gradle.kts`:
- Around line 252-282: The exportOpenApi task currently misses the APP_VERSION
as an input, so Gradle can reuse a cached output when the APP_VERSION
environment variable changes; add an inputs.property entry to the
tasks.register("exportOpenApi") configuration (before doLast) that declares the
APP_VERSION (e.g. inputs.property("APP_VERSION", System.getenv("APP_VERSION") ?:
"")) so Gradle will consider APP_VERSION when up-to-date checking and not reuse
stale openApiOutputFile / grimmory-openapi.json produced by exportOpenApi.

In `@backend/scripts/export-openapi.sh`:
- Around line 18-38: The script currently chooses an ephemeral port into
variable port, closes the socket, then starts the JVM which creates a race;
change this by either (A) letting Spring bind port 0 and discovering the
assigned port from the running process (start org.booklore.BookloreApplication
with -Dserver.port=0, tail/grep the application log for the bound port or probe
the application’s /actuator or /api/openapi.json endpoint repeatedly until it
responds and then set endpoint accordingly) or (B) implement a safe startup
retry: after picking port as done today, start the JVM (using "$java_executable"
launching org.booklore.BookloreApplication) and if startup fails to bind that
port detect the failure (check process exit or log for “Address already in use”)
then pick a new ephemeral port and retry a limited number of times before
failing; update variables port, endpoint, app_pid and log handling accordingly
so there is no window where another process can claim the chosen port.
- Around line 54-56: The current check uses grep to look for the string
"openapi" which accepts false positives; instead parse and validate the fetched
JSON by using a JSON parser (e.g., jq) on "$output_file" and verify it contains
a top-level "openapi" field (e.g., test that .openapi exists and is a string)
before exiting successfully; update the conditional around the curl/grep block
(referencing variables endpoint and output_file) to run a jq validation step and
fail (non-zero exit) if the file is not valid OpenAPI JSON.