Add production Docker compose + on-startup PocketBase bootstrap

Introduce registry-pull production stacks (docker-compose.prod.yml) for
both the multi-container Docker setup and the all-in-one Docker AIO image,
with everything an operator needs (superuser, super-admin, ports, volumes)
driven from .env.

The API Server now bootstraps PocketBase on startup: a new internal/bootstrap
package (Go port of setup-pocketbase.mjs) creates missing collections,
reconciles existing ones, and creates the DriverVault super-admin from
DRIVERVAULT_SUPERADMIN_* when absent. Idempotent and gated by PB_BOOTSTRAP.
The PocketBase superuser is still upserted by the PocketBase container, since
the REST API cannot bootstrap the first superuser.

Move PocketBase to port 8070 (internal + published) and the web app to 8090
across both stacks, with matching CORS defaults.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Docker/.env.example

@@ -7,13 +7,13 @@ PB_ADMIN_PASSWORD=change-me-long-password
 # --- API Server -------------------------------------------------------------
 # Allowed CORS origin(s) for the web app (match WEB_PORT / your public URL).
 # Native mobile apps are not subject to CORS.
-CORS_ALLOW_ORIGINS=http://localhost:8081
+CORS_ALLOW_ORIGINS=http://localhost:8090
 AUTH_USERS_COLLECTION=users
 
 # --- Host port mappings (optional; defaults shown) --------------------------
-PB_PORT=8090
+PB_PORT=8070
 API_PORT=8080
-WEB_PORT=8081
+WEB_PORT=8090
 
 # --- Web App build -----------------------------------------------------------
 # Leave empty so the browser uses same-origin /api (proxied by the BFF).