Add production Docker compose + on-startup PocketBase bootstrap

Introduce registry-pull production stacks (docker-compose.prod.yml) for
both the multi-container Docker setup and the all-in-one Docker AIO image,
with everything an operator needs (superuser, super-admin, ports, volumes)
driven from .env.

The API Server now bootstraps PocketBase on startup: a new internal/bootstrap
package (Go port of setup-pocketbase.mjs) creates missing collections,
reconciles existing ones, and creates the DriverVault super-admin from
DRIVERVAULT_SUPERADMIN_* when absent. Idempotent and gated by PB_BOOTSTRAP.
The PocketBase superuser is still upserted by the PocketBase container, since
the REST API cannot bootstrap the first superuser.

Move PocketBase to port 8070 (internal + published) and the web app to 8090
across both stacks, with matching CORS defaults.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Docker AIO/.env.example

@@ -5,9 +5,22 @@
 PB_ADMIN_EMAIL=admin@example.com
 PB_ADMIN_PASSWORD=change-me-long-password
 
+# --- DriverVault super-admin (app login) -------------------------------------
+# The first application user, created by the API Server on boot with role
+# "superadmin" if no user with this email exists yet. Leave blank to skip.
+DRIVERVAULT_SUPERADMIN_EMAIL=owner@example.com
+DRIVERVAULT_SUPERADMIN_PASSWORD=change-me-long-password
+DRIVERVAULT_SUPERADMIN_NAME=Administrator
+
+# Set to false to skip schema creation/reconcile once the database is set up.
+PB_BOOTSTRAP=true
+
+# Allowed CORS origin(s) — match your web origin / WEB_PORT.
+CORS_ALLOW_ORIGINS=http://localhost:8090
+
 # --- Host port mappings (optional; defaults shown) --------------------------
-WEB_PORT=80
-PB_PORT=8090
+WEB_PORT=8090
+PB_PORT=8070
 # API Server + its embedded web panel (served at the API root, http://host:8080/).
 API_PORT=8080