Add production Docker compose + on-startup PocketBase bootstrap

Introduce registry-pull production stacks (docker-compose.prod.yml) for
both the multi-container Docker setup and the all-in-one Docker AIO image,
with everything an operator needs (superuser, super-admin, ports, volumes)
driven from .env.

The API Server now bootstraps PocketBase on startup: a new internal/bootstrap
package (Go port of setup-pocketbase.mjs) creates missing collections,
reconciles existing ones, and creates the DriverVault super-admin from
DRIVERVAULT_SUPERADMIN_* when absent. Idempotent and gated by PB_BOOTSTRAP.
The PocketBase superuser is still upserted by the PocketBase container, since
the REST API cannot bootstrap the first superuser.

Move PocketBase to port 8070 (internal + published) and the web app to 8090
across both stacks, with matching CORS defaults.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Docker/.env.prod.example

@@ -0,0 +1,49 @@
+# DriverVault — production stack config.
+# Copy to .env and fill in, then:
+#   docker compose -f docker-compose.prod.yml pull
+#   docker compose -f docker-compose.prod.yml up -d
+
+# --- Registry images ---------------------------------------------------------
+# Defaults point at the internal registry; override to pin a tag or use a mirror.
+PB_IMAGE=10.2.1.10:5500/admin/drivervault-pocketbase:latest
+API_IMAGE=10.2.1.10:5500/admin/drivervault-api-server:latest
+WEB_IMAGE=10.2.1.10:5500/admin/drivervault-web-app:latest
+
+# --- PocketBase superuser ----------------------------------------------------
+# Created/updated on the PocketBase container's first boot. The API Server uses
+# these same credentials to manage the database. REQUIRED.
+PB_ADMIN_EMAIL=admin@example.com
+PB_ADMIN_PASSWORD=change-me-long-password
+
+# --- DriverVault super-admin (app login) -------------------------------------
+# The first application user, created by the API Server on boot with role
+# "superadmin" if no user with this email exists yet. Leave blank to skip and
+# create the first user by hand. This is the account you log in to the web app
+# with — distinct from the PocketBase superuser above.
+DRIVERVAULT_SUPERADMIN_EMAIL=owner@example.com
+DRIVERVAULT_SUPERADMIN_PASSWORD=change-me-long-password
+DRIVERVAULT_SUPERADMIN_NAME=Administrator
+
+# Set to false to skip schema creation/reconcile once the database is set up.
+PB_BOOTSTRAP=true
+
+# --- API Server --------------------------------------------------------------
+# Allowed CORS origin(s) for the web app (match your public URL / WEB_PORT).
+CORS_ALLOW_ORIGINS=http://localhost:8090
+AUTH_USERS_COLLECTION=users
+
+# --- Ports -------------------------------------------------------------------
+# WEB_PORT is the public front door (bound on all interfaces).
+WEB_PORT=8090
+# PocketBase admin UI and the API panel are bound to localhost only by default.
+# Set PB_BIND / API_BIND to 0.0.0.0 to expose them on the network.
+PB_PORT=8070
+PB_BIND=127.0.0.1
+API_PORT=8080
+API_BIND=127.0.0.1
+
+# --- Storage -----------------------------------------------------------------
+# Default is a Docker-managed named volume ("pb_data"). To store the database on
+# a host path instead, set PB_DATA to an absolute path, e.g.:
+#   PB_DATA=/srv/drivervault/pb_data
+PB_DATA=pb_data