Refresh docs and fix Docker builds for current layout

READMEs: correct the auth model (PocketBase token relay, not JWT/sessions),
document the full feature set (technical checks, fuel, maintenance, documents,
reminders, attachments, integrations, OCPP charging control), the shipping
built-in connectors (toyota, anker-solix), and the current endpoint surface.

Docker: build against the current repo layout — Go 1.26, cmd/server entry
point, Web App source under web/. Add the missing Web App Dockerfile (Go BFF)
and .dockerignore, drop the obsolete AUTH_SECRET, modernise CORS var naming,
and standardise on drivervault-* naming.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API Server/docker-compose.yml

@@ -3,8 +3,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    image: carcontrol-api
-    container_name: carcontrol-api
+    image: drivervault-api
+    container_name: drivervault-api
     restart: unless-stopped
     ports:
       - "${PORT:-8080}:8080"
@@ -13,8 +13,10 @@ services:
       PORT: "8080"
       # External PocketBase instance (all DB access goes through this server).
       PB_URL: "${PB_URL:-http://10.2.1.10:8027}"
+      # Superuser service account. Leave unset and the server still starts — a
+      # superadmin can configure it from the panel; management endpoints 503 until then.
       PB_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
       PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
-      CORS_ORIGINS: "${CORS_ORIGINS:-http://localhost:5173}"
-      AUTH_SECRET: "${AUTH_SECRET}"
+      # Browser origins allowed by CORS (native apps are exempt).
+      CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:5173}"
       AUTH_USERS_COLLECTION: "${AUTH_USERS_COLLECTION:-users}"