Docker: persist API Server state, wire up OCPP, drop legacy env names

Audited every Dockerfile, compose file and .env.example against the code
they deploy. Four things had drifted:

Persistence. The API Server writes plugins.json and rewrites .env (the
panel's retarget-PocketBase flow) relative to its working directory,
which was a root-owned /app while the process runs as the app user - so
both writes failed, and no volume was declared to keep them anyway. The
binary moves to /usr/local/bin and the working directory becomes a /data
volume owned by app. The AIO image gets the same via directory=/data on
its supervisord program.

OCPP. Charger control was undeployable: OCPP_REQUIRE_TLS defaults to true
and appeared in no Docker file, so a charger dialling the plain-HTTP
/ocpp/{serial} was rejected with nothing explaining why. Both OCPP vars
are now threaded through the compose files and env examples, with the
reasoning (the per-charger control token rides in a Basic-auth header).

CORS. API Server/docker-compose.yml defaulted to localhost:5173, the Vite
dev port, where every other file uses 8090.

Env names. .env.example has called PB_URL/PB_ADMIN_*/PORT legacy for a
while, but the Docker layer still used them. Container-side names are now
POCKETBASE_*/API_ADDR; the .env keys operators set stay PB_ADMIN_* so
existing .env files keep working.

Left alone deliberately: alpine:latest stays unpinned (cannot verify
current tags or test the build from here), and the golang/node bases
already match go.mod and Vite 8's floor.

Validated as YAML only - there is no Docker CLI on this machine, so no
image was built and the /data ownership fix follows standard volume
semantics rather than an observed run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Docker AIO/Dockerfile

@@ -15,6 +15,7 @@
 #     -e DRIVERVAULT_SUPERADMIN_EMAIL=owner@example.com \
 #     -e DRIVERVAULT_SUPERADMIN_PASSWORD=change-me \
 #     -v drivervault_pb:/pb/pb_data \
+#     -v drivervault_api:/data \
 #     drivervault-aio
 #
 # Then: web app on http://host/  and PocketBase admin on http://host:8070/_/
@@ -127,8 +128,11 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
-; API Server: wait for PocketBase to be healthy, then start.
+; API Server: wait for PocketBase to be healthy, then start. It runs from /data
+; because it writes plugins.json and the panel's .env relative to its working
+; directory, and /data is the volume that keeps them across container recreates.
 [program:api-server]
+directory=/data
 command=/bin/sh -c 'until wget -qO- http://127.0.0.1:8070/api/health >/dev/null 2>&1; do echo "waiting for pocketbase..."; sleep 1; done; exec /usr/local/bin/api-server'
 priority=20
 autostart=true
@@ -150,18 +154,28 @@ stderr_logfile_maxbytes=0
 SUPERVISOR
 
 # API Server config: everything is local to this container.
-ENV PORT=8080 \
-    PB_URL=http://127.0.0.1:8070 \
+ENV API_ADDR=:8080 \
+    POCKETBASE_URL=http://127.0.0.1:8070 \
     CORS_ALLOW_ORIGINS=http://localhost:8090 \
-    AUTH_USERS_COLLECTION=users
+    AUTH_USERS_COLLECTION=users \
+    PLUGINS_FILE=/data/plugins.json
 
 # Required at runtime (no safe defaults): PB_ADMIN_EMAIL, PB_ADMIN_PASSWORD.
 # Optional: DRIVERVAULT_SUPERADMIN_EMAIL / DRIVERVAULT_SUPERADMIN_PASSWORD create
 # the first app super-admin on boot; PB_BOOTSTRAP=false skips schema setup.
+# For Anker Solix charger control, OCPP_REQUIRE_TLS (default true) rejects
+# chargers that did not arrive over TLS — this image serves plain HTTP, so put a
+# TLS-terminating proxy in front and set OCPP_PUBLIC_URL to the public wss://
+# base, or set OCPP_REQUIRE_TLS=false on a trusted network.
 # Pass them with `docker run -e ...`.
 
+RUN mkdir -p /data
+# pb_data holds the database; /data holds the API Server's plugins.json and the
+# .env the panel rewrites when a superadmin retargets PocketBase.
 VOLUME /pb/pb_data
-# 80 = Web App, 8070 = PocketBase admin, 8080 = API Server + embedded API panel.
+VOLUME /data
+# 80 = Web App, 8070 = PocketBase admin, 8080 = API Server + embedded API panel
+# (also the /ocpp/{serial} endpoint chargers dial into).
 EXPOSE 80 8070 8080
 
 CMD ["supervisord", "-c", "/etc/supervisord.conf"]