Rebuild API Server on the PilotVault structure

Mirror PilotVault's API Server layout and add the superadmin console,
plugin system, runtime PocketBase settings, and user/organization
management. The car domain (cars, service records, parts, sharing) is
carried over unchanged apart from the auth switch.

Layout: main.go -> cmd/server/main.go; module carcontrol/api ->
drivervault/apiserver. internal/api is split by concern (auth, users,
orgs, settings, plugins, status, health, respond).

Auth: replace the server-minted HS256 JWT and the sessions collection
with a PocketBase token proxy. /api/auth/login relays PocketBase's
{token, record}, and every protected request re-resolves that token
against PocketBase, so a role change or deletion takes effect at once
instead of waiting out a token. AUTH_SECRET is obsolete and internal/auth
is gone. Per-device session listing/revocation goes with it: PocketBase
tokens are stateless. Changing a password rotates the user's token key,
which invalidates every token already issued.

Roles: add superadmin alongside user/admin, plus an organizations
collection and users.organization. Admins are scoped to their own
organization; superadmins span all of them. Guards prevent changing your
own role, deleting your own account, an admin touching a superadmin, and
deleting an organization that still has members.

Plugins: new internal/plugins package with one contract over two kinds --
builtin (compiled in) and external (any HTTP service, registered at
runtime with no rebuild). State persists to plugins.json; secrets are
masked on read and preserved when saved back at the mask.

PocketBase settings: /api/admin/pb-config applies a new connection at
runtime and persists it to .env. It deliberately does not require a
working service account, so a wrong or unreachable connection can still
be fixed from the panel.

Panel: rebuilt as the superadmin console -- login gate, status, users,
organizations, PocketBase, plugins, and the endpoint reference.

Clients: update the Web App and Phone App for the PocketBase token shape,
the move of user management to /api/users ({users}/{user} envelopes, with
password resets folded into PATCH), and the removal of sessions. Both now
mirror the server's real guards rather than the old last-admin rule, and
parse PocketBase's field-level error shape.

Config: modern POCKETBASE_*/API_ADDR names with legacy PB_*/PORT
fallbacks, so existing .env files keep working. Also fixes /api/status
probing the Web App on 8090 instead of DriverVault's 5173.

Run scripts/setup-pocketbase.mjs to add the organizations collection and
grow users.role; every client must log in once more.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API Server/scripts/setup-pocketbase.mjs

@@ -120,6 +120,7 @@ async function createCollection(token, name, defs, format, idByName) {
     updateRule: null,
     deleteRule: null,
   };
+  if (INDEXES[name]) body.indexes = INDEXES[name];
   const res = await fetch(PB_URL + "/api/collections", {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: token },
@@ -247,6 +248,12 @@ const DESIRED = {
     F.select("permission", ["read", "write"], true),
     F.autodate("created", true, false),
   ],
+  // Tenants that users belong to. A superadmin spans all of them; an admin
+  // manages only their own.
+  organizations: [
+    F.text("name", true),
+    F.autodate("created", true, false),
+  ],
   // Custom fields layered onto the built-in "users" auth collection (which
   // already ships with email/name/avatar). Settings-panel additions:
   users: [
@@ -257,22 +264,20 @@ const DESIRED = {
     F.select("font_size", ["small", "medium", "large"]),
     F.date("deletion_requested_at"),
     // Access role. Empty value is treated as "user" by the API.
-    F.select("role", ["user", "admin"]),
-  ],
-  // One row per issued login token, so "active sessions" can be listed and
-  // individually revoked without needing a stateful session store elsewhere.
-  sessions: [
-    F.relation("user", "users", true),
-    F.text("jti", true),
-    F.text("device_label"),
-    F.text("ip"),
-    F.text("user_agent"),
-    F.bool("revoked"),
-    F.date("expires_at", true),
-    F.autodate("created", true, false),
+    F.select("role", ["user", "admin", "superadmin"]),
+    // Organization membership. Non-cascading on purpose: deleting an org must
+    // not delete its people. (The API refuses to delete an org that still has
+    // members, so this should not arise in practice.)
+    F.relation("organization", "organizations", false, false),
   ],
 };
 
+// Extra SQL indexes, applied at collection-create time. Organization names are
+// unique so the API can rely on PocketBase rejecting a duplicate.
+const INDEXES = {
+  organizations: ["CREATE UNIQUE INDEX `idx_organizations_name` ON `organizations` (`name`)"],
+};
+
 async function main() {
   console.log(`Connecting to ${PB_URL} ...`);
   const token = await authenticate();
@@ -285,10 +290,10 @@ async function main() {
   const idByName = {};
   for (const c of collections) idByName[c.name] = c.id;
 
-  // Create in dependency order (cars before its relations; "users" already
-  // exists as PocketBase's built-in auth collection, so it's never created
-  // here — only reconciled below).
-  for (const name of ["cars", "service_records", "parts", "sessions", "car_shares"]) {
+  // Create in dependency order (organizations before users references it; cars
+  // before its relations; "users" already exists as PocketBase's built-in auth
+  // collection, so it's never created here — only reconciled below).
+  for (const name of ["organizations", "cars", "service_records", "parts", "car_shares"]) {
     if (collections.some((c) => c.name === name)) continue;
     await createCollection(token, name, DESIRED[name], format, idByName);
     console.log(`✓ ${name} — created`);
@@ -297,12 +302,20 @@ async function main() {
     for (const c of collections) idByName[c.name] = c.id;
   }
 
-  // Reconcile fields on existing collections (add missing + fix relation options).
-  for (const name of ["users", "cars", "service_records", "parts", "sessions", "car_shares"]) {
+  // Reconcile fields on existing collections (add missing + fix relation options
+  // and select values — this is what grows users.role to include "superadmin"
+  // and adds users.organization on an existing deployment).
+  for (const name of ["organizations", "users", "cars", "service_records", "parts", "car_shares"]) {
     await reconcileFields(token, name, DESIRED[name], format, idByName);
   }
 
-  console.log("\nDone. Collections ready: users, cars, service_records, parts, sessions, car_shares.");
+  console.log(
+    "\nDone. Collections ready: organizations, users, cars, service_records, parts, car_shares.",
+  );
+  console.log(
+    "Note: the legacy `sessions` collection is no longer used (auth moved to PocketBase\n" +
+      "tokens). It is left in place rather than dropped — delete it by hand if you want.",
+  );
 }
 
 main().catch((err) => {