Refresh docs and fix Docker builds for current layout

READMEs: correct the auth model (PocketBase token relay, not JWT/sessions),
document the full feature set (technical checks, fuel, maintenance, documents,
reminders, attachments, integrations, OCPP charging control), the shipping
built-in connectors (toyota, anker-solix), and the current endpoint surface.

Docker: build against the current repo layout — Go 1.26, cmd/server entry
point, Web App source under web/. Add the missing Web App Dockerfile (Go BFF)
and .dockerignore, drop the obsolete AUTH_SECRET, modernise CORS var naming,
and standardise on drivervault-* naming.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Docker/docker-compose.yml

@@ -1,15 +1,15 @@
-name: carcontrol
+name: drivervault
 
-# Full Car Control / DriverVault stack: PocketBase (database) + API Server + Web App.
-# Traffic flow (browser): Web App (nginx) --/api--> API Server --> PocketBase.
+# Full DriverVault stack: PocketBase (database) + API Server + Web App.
+# Traffic flow (browser): Web App BFF --/api--> API Server --> PocketBase.
 # Copy .env.example to .env and fill in the secrets before `docker compose up`.
 
 services:
   pocketbase:
     build:
       context: ./pocketbase
-    image: carcontrol-pocketbase
-    container_name: carcontrol-pocketbase
+    image: drivervault-pocketbase
+    container_name: drivervault-pocketbase
     restart: unless-stopped
     environment:
       # Superuser is created/updated on boot so the API Server can authenticate.
@@ -30,8 +30,8 @@ services:
   api-server:
     build:
       context: ../API Server
-    image: carcontrol-api
-    container_name: carcontrol-api
+    image: drivervault-api
+    container_name: drivervault-api
     restart: unless-stopped
     depends_on:
       pocketbase:
@@ -42,21 +42,20 @@ services:
       PB_URL: "http://pocketbase:8090"
       PB_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
       PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
-      AUTH_SECRET: "${AUTH_SECRET:?set AUTH_SECRET in .env}"
-      # Same-origin requests go through nginx, so CORS is only needed if the
-      # browser ever calls the API Server directly. Default to the web origin.
-      CORS_ORIGINS: "${CORS_ORIGINS:-http://localhost:8081}"
+      # Same-origin requests go through the Web App BFF, so CORS is only needed
+      # if the browser ever calls the API Server directly. Default to the web origin.
+      CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8081}"
       AUTH_USERS_COLLECTION: "${AUTH_USERS_COLLECTION:-users}"
     ports:
-      # Optional direct access to the API Server; the Web App uses the internal
-      # network, not this host port.
+      # Optional direct access to the API Server (and its panel at /); the Web
+      # App reaches it over the internal network, not this host port.
       - "${API_PORT:-8080}:8080"
 
   web-app:
     build:
       context: ../Web App
       args:
-        # Empty -> bundle uses same-origin "/api", which nginx proxies below.
+        # Empty -> bundle uses same-origin "/api", which the BFF proxies below.
         VITE_API_BASE: "${VITE_API_BASE:-}"
     image: drivervault-web
     container_name: drivervault-web
@@ -64,10 +63,10 @@ services:
     depends_on:
       - api-server
     environment:
-      # nginx proxies /api/ to the API Server over the internal network.
-      API_TARGET: "http://api-server:8080"
+      # The BFF reverse-proxies /api/* to the API Server over the internal network.
+      API_BASE: "http://api-server:8080"
     ports:
-      - "${WEB_PORT:-8081}:80"
+      - "${WEB_PORT:-8081}:8090"
 
 volumes:
   pb_data: