Docs: refresh every README against the current code

Verified each documented command, path, port and env var against what the
code actually does, and corrected the drift.

Phone App. Was still titled Car Control. The navigation description was
also stale: the app moved to a RootShell bottom nav (Garage, Charging,
Settings, and Users for admins), so the Settings gear and admin action
the dashboard bullet described no longer exist. Adds the Charging screen,
noting its public tab is placeholder data and only the Home tab's OCPP
control is real, and rebuilds the lib/ tree, which had lost i18n.dart,
theme.dart, widgets/ and three screens.

Web App. Node 18+ was wrong. The installed Vite is 8.1.2, whose engines
field is ^20.19.0 || >=22.12.0 - Node 18 is EOL and cannot build this.

API Server. The config table gained OCPP_REQUIRE_TLS, OCPP_PUBLIC_URL,
PB_BOOTSTRAP and DRIVERVAULT_SUPERADMIN_*, plus a note that PLUGINS_FILE
and the panel-written .env resolve against the working directory (a
volume, in Docker).

Plugins. Per-tenant credentials sat under "not yet implemented", but
/api/integrations/* has done exactly that for both built-ins for a while.
Narrowed the roadmap item to the genuinely missing generic version.

New Docker/README.md and Docker AIO/README.md: the root README's
component table linked those directories as documentation but neither had
any. The root README now points at them.

All 8 markdown files pass a relative-link check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API Server/internal/plugins/README.md

@@ -303,8 +303,14 @@ The contract is shaped for these; see [`doc.go`](doc.go):
 - **Invocation API** — an endpoint to call `Invoke` from clients, with a normalized
   request/response envelope and a provider→internal mapper.
 - **Resilience** — retry/backoff, circuit breaker, per-plugin latency/error metrics.
-- **Per-tenant credentials** — config keyed by org/user so users connect their own accounts.
-- **Audit logging** of plugin access.
+- **Per-tenant credentials _for arbitrary plugins_** — the two built-in connectors
+  already have them, through the hand-written `/api/integrations/toyota` and
+  `/api/integrations/anker-solix` routes and their **superadmin → org admin →
+  user** config cascade. What is missing is the generic version: per-org/per-user
+  config keyed off `ConfigFields`, so a newly registered plugin gets the same
+  treatment without new endpoints.
+- **Audit logging** of plugin access. (Charger *control* commands are already
+  audited to the `control_audit` collection; this is the wider plugin case.)
 
 Until the invocation API lands, `Invoke` is dormant — plugins are discoverable,
 configurable, and health-checked, but not yet callable over HTTP.