Docker: persist API Server state, wire up OCPP, drop legacy env names

Audited every Dockerfile, compose file and .env.example against the code
they deploy. Four things had drifted:

Persistence. The API Server writes plugins.json and rewrites .env (the
panel's retarget-PocketBase flow) relative to its working directory,
which was a root-owned /app while the process runs as the app user - so
both writes failed, and no volume was declared to keep them anyway. The
binary moves to /usr/local/bin and the working directory becomes a /data
volume owned by app. The AIO image gets the same via directory=/data on
its supervisord program.

OCPP. Charger control was undeployable: OCPP_REQUIRE_TLS defaults to true
and appeared in no Docker file, so a charger dialling the plain-HTTP
/ocpp/{serial} was rejected with nothing explaining why. Both OCPP vars
are now threaded through the compose files and env examples, with the
reasoning (the per-charger control token rides in a Basic-auth header).

CORS. API Server/docker-compose.yml defaulted to localhost:5173, the Vite
dev port, where every other file uses 8090.

Env names. .env.example has called PB_URL/PB_ADMIN_*/PORT legacy for a
while, but the Docker layer still used them. Container-side names are now
POCKETBASE_*/API_ADDR; the .env keys operators set stay PB_ADMIN_* so
existing .env files keep working.

Left alone deliberately: alpine:latest stays unpinned (cannot verify
current tags or test the build from here), and the golang/node bases
already match go.mod and Vite 8's floor.

Validated as YAML only - there is no Docker CLI on this machine, so no
image was built and the /data ownership fix follows standard volume
semantics rather than an observed run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Docker/docker-compose.yml

@@ -37,19 +37,30 @@ services:
       pocketbase:
         condition: service_healthy
     environment:
-      PORT: "8080"
+      API_ADDR: ":8080"
       # Reach PocketBase by its service name on the internal network.
-      PB_URL: "http://pocketbase:8070"
-      PB_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
-      PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
+      POCKETBASE_URL: "http://pocketbase:8070"
+      POCKETBASE_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
+      POCKETBASE_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
       # Same-origin requests go through the Web App BFF, so CORS is only needed
       # if the browser ever calls the API Server directly. Default to the web origin.
       CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
       AUTH_USERS_COLLECTION: "${AUTH_USERS_COLLECTION:-users}"
+      # OCPP charger control (Anker Solix). Chargers are rejected unless they
+      # connect over TLS; set OCPP_REQUIRE_TLS=false in .env only when TLS is
+      # terminated in front of this stack or for local dev on a trusted network.
+      OCPP_REQUIRE_TLS: "${OCPP_REQUIRE_TLS:-true}"
+      OCPP_PUBLIC_URL: "${OCPP_PUBLIC_URL:-}"
     ports:
       # Optional direct access to the API Server (and its panel at /); the Web
-      # App reaches it over the internal network, not this host port.
+      # App reaches it over the internal network, not this host port. Chargers
+      # dialling /ocpp/{serial} also arrive here.
       - "${API_PORT:-8080}:8080"
+    volumes:
+      # plugins.json + the .env the panel writes back — see the API Server
+      # Dockerfile. Without this, plugin state is lost when the container is
+      # recreated.
+      - api_data:/data
 
   web-app:
     build:
@@ -70,3 +81,4 @@ services:
 
 volumes:
   pb_data:
+  api_data: