Docker: give the panel's settings screens a permanent home in .env

ee4ac44 removed the api_data volume, which left the panel's Settings ->
PocketBase and Settings -> Web App screens with nowhere to persist to: they
apply at runtime and the container environment wins again on restart. That
is only acceptable if the environment is actually reachable by an operator,
and for two of those keys it was not - WEBAPP_URL was hardcoded in all four
compose files, and POCKETBASE_URL in the two multi-container ones, so
there was no supported way to change them at all.

Both are now ${VAR:-default} with the previous hardcoded value as the
default, so nothing moves for an existing .env while the keys become
settable. CORS_ALLOW_ORIGINS and the admin credentials already were.

The env examples grow a section naming every setting the panel can also
change, saying plainly that the panel's version lasts only for the life of
the container, and giving the commented-out line to make it stick. It also
records the trap in WEBAPP_URL: it is a container-to-container call, so it
has to be reachable from the API Server rather than from a browser, which
is why the default is a service name and not localhost. POCKETBASE_URL is
described as repointable in the multi-container stack and left alone in the
AIO image, where it addresses that container's own PocketBase.

Also dropped two leftovers from when there were two volumes: the storage
sections still said "either".

Checked by parsing all five compose files and asserting each interpolation
default matches the value it replaced, so this cannot have moved a default
by accident. go build and go test ./... still pass (untouched here). Not
verified: no Docker CLI, so no `docker compose config` render and no build.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Docker-AIO/.env.prod.example

@@ -44,8 +44,18 @@ WEB_PORT=8090
 PB_PORT=8070
 API_PORT=8080
 
+# --- Settings the API Server panel can also change ---------------------------
+# The panel's Settings screens apply these immediately, but only for the life of
+# the container — the value below is re-applied on every restart and wins. Set it
+# here to make a change permanent. (POCKETBASE_URL is fixed to this container's
+# own PocketBase and is not meant to be repointed.)
+#   WEBAPP_URL          the Web App address the panel status page probes; nginx
+#                       serves it on port 80 inside this container.
+#   CORS_ALLOW_ORIGINS  browser origins allowed to call the API Server directly.
+# WEBAPP_URL=http://127.0.0.1:80
+
 # --- Storage -----------------------------------------------------------------
-# Defaults are Docker-managed named volumes. Set either to an absolute host path
+# One Docker-managed named volume by default. Set it to an absolute host path
 # for a bind mount, e.g. PB_DATA=/srv/drivervault/pb_data.
 # PB_DATA — the PocketBase database and uploads. It is the only volume in the
 # image: the API Server keeps no state on disk, so everything it owns (plugin