Rebuild API Server on the PilotVault structure

Mirror PilotVault's API Server layout and add the superadmin console,
plugin system, runtime PocketBase settings, and user/organization
management. The car domain (cars, service records, parts, sharing) is
carried over unchanged apart from the auth switch.

Layout: main.go -> cmd/server/main.go; module carcontrol/api ->
drivervault/apiserver. internal/api is split by concern (auth, users,
orgs, settings, plugins, status, health, respond).

Auth: replace the server-minted HS256 JWT and the sessions collection
with a PocketBase token proxy. /api/auth/login relays PocketBase's
{token, record}, and every protected request re-resolves that token
against PocketBase, so a role change or deletion takes effect at once
instead of waiting out a token. AUTH_SECRET is obsolete and internal/auth
is gone. Per-device session listing/revocation goes with it: PocketBase
tokens are stateless. Changing a password rotates the user's token key,
which invalidates every token already issued.

Roles: add superadmin alongside user/admin, plus an organizations
collection and users.organization. Admins are scoped to their own
organization; superadmins span all of them. Guards prevent changing your
own role, deleting your own account, an admin touching a superadmin, and
deleting an organization that still has members.

Plugins: new internal/plugins package with one contract over two kinds --
builtin (compiled in) and external (any HTTP service, registered at
runtime with no rebuild). State persists to plugins.json; secrets are
masked on read and preserved when saved back at the mask.

PocketBase settings: /api/admin/pb-config applies a new connection at
runtime and persists it to .env. It deliberately does not require a
working service account, so a wrong or unreachable connection can still
be fixed from the panel.

Panel: rebuilt as the superadmin console -- login gate, status, users,
organizations, PocketBase, plugins, and the endpoint reference.

Clients: update the Web App and Phone App for the PocketBase token shape,
the move of user management to /api/users ({users}/{user} envelopes, with
password resets folded into PATCH), and the removal of sessions. Both now
mirror the server's real guards rather than the old last-admin rule, and
parse PocketBase's field-level error shape.

Config: modern POCKETBASE_*/API_ADDR names with legacy PB_*/PORT
fallbacks, so existing .env files keep working. Also fixes /api/status
probing the Web App on 8090 instead of DriverVault's 5173.

Run scripts/setup-pocketbase.mjs to add the organizations collection and
grow users.role; every client must log in once more.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API Server/.env.example

@@ -1,22 +1,37 @@
-# Copy to .env and fill in. The server reads these at startup.
+# API Server configuration
+# Copy to .env and adjust. The server also reads plain environment variables.
+# Never commit the real .env file.
 
-# Address the API Server listens on.
-PORT=8080
+# Address the API Server listens on. A bare port (8080) is accepted too.
+API_ADDR=:8080
 
-# PocketBase instance (database). All DB access goes through this server.
-PB_URL=http://10.2.1.10:8027
+# PocketBase base URL (no trailing slash). The API Server is the only thing that
+# talks to PocketBase; it proxies /api/auth/* to this address, which is never
+# exposed to clients. Editable at runtime from the panel (PocketBase section),
+# which writes the change back into this file.
+POCKETBASE_URL=http://10.2.1.10:8027
 
-# PocketBase superuser (admin) credentials. Used by the API Server to
-# authenticate against PocketBase. Never commit the real .env file.
-PB_ADMIN_EMAIL=
-PB_ADMIN_PASSWORD=
+# PocketBase superuser service account. Every privileged flow runs through it:
+# user/organization management and all car-domain database access. Leave unset
+# and the server still starts — a superadmin can log in to the panel and
+# configure it there; management endpoints return 503 until then.
+POCKETBASE_ADMIN_EMAIL=
+POCKETBASE_ADMIN_PASSWORD=
 
-# Comma-separated list of allowed CORS origins for the web app (dev default).
-CORS_ORIGINS=http://localhost:5173
+# CORS allowed origins for browser clients (comma separated, or * for any).
+# Native mobile apps are not subject to CORS.
+CORS_ALLOW_ORIGINS=http://localhost:5173
 
-# Secret used to sign auth (JWT) tokens. MUST be set to a long random value in
-# production. If unset, the server falls back to an insecure dev secret.
-AUTH_SECRET=
+# Web App address, probed by GET /api/status and shown on the panel.
+WEBAPP_URL=http://localhost:5173
 
 # PocketBase auth collection holding app users (default: users).
 AUTH_USERS_COLLECTION=users
+
+# Local JSON store for plugin enable-state + config (default: plugins.json).
+PLUGINS_FILE=plugins.json
+
+# --- Legacy names -----------------------------------------------------------
+# PB_URL, PB_ADMIN_EMAIL, PB_ADMIN_PASSWORD, PORT and CORS_ORIGINS are still
+# honoured for older deployments; the POCKETBASE_*/API_ADDR names above win when
+# both are set. AUTH_SECRET is gone — the server no longer mints its own JWTs.