Rebuild API Server on the PilotVault structure

Mirror PilotVault's API Server layout and add the superadmin console,
plugin system, runtime PocketBase settings, and user/organization
management. The car domain (cars, service records, parts, sharing) is
carried over unchanged apart from the auth switch.

Layout: main.go -> cmd/server/main.go; module carcontrol/api ->
drivervault/apiserver. internal/api is split by concern (auth, users,
orgs, settings, plugins, status, health, respond).

Auth: replace the server-minted HS256 JWT and the sessions collection
with a PocketBase token proxy. /api/auth/login relays PocketBase's
{token, record}, and every protected request re-resolves that token
against PocketBase, so a role change or deletion takes effect at once
instead of waiting out a token. AUTH_SECRET is obsolete and internal/auth
is gone. Per-device session listing/revocation goes with it: PocketBase
tokens are stateless. Changing a password rotates the user's token key,
which invalidates every token already issued.

Roles: add superadmin alongside user/admin, plus an organizations
collection and users.organization. Admins are scoped to their own
organization; superadmins span all of them. Guards prevent changing your
own role, deleting your own account, an admin touching a superadmin, and
deleting an organization that still has members.

Plugins: new internal/plugins package with one contract over two kinds --
builtin (compiled in) and external (any HTTP service, registered at
runtime with no rebuild). State persists to plugins.json; secrets are
masked on read and preserved when saved back at the mask.

PocketBase settings: /api/admin/pb-config applies a new connection at
runtime and persists it to .env. It deliberately does not require a
working service account, so a wrong or unreachable connection can still
be fixed from the panel.

Panel: rebuilt as the superadmin console -- login gate, status, users,
organizations, PocketBase, plugins, and the endpoint reference.

Clients: update the Web App and Phone App for the PocketBase token shape,
the move of user management to /api/users ({users}/{user} envelopes, with
password resets folded into PATCH), and the removal of sessions. Both now
mirror the server's real guards rather than the old last-admin rule, and
parse PocketBase's field-level error shape.

Config: modern POCKETBASE_*/API_ADDR names with legacy PB_*/PORT
fallbacks, so existing .env files keep working. Also fixes /api/status
probing the Web App on 8090 instead of DriverVault's 5173.

Run scripts/setup-pocketbase.mjs to add the organizations collection and
grow users.role; every client must log in once more.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Web App/web/src/auth.js

@@ -15,19 +15,27 @@ export const state = reactive({
 
 export const isAuthenticated = computed(() => !!state.token);
 
+// Roles that may manage users. A superadmin is an admin that also spans every
+// organization; the API Server enforces the difference, the UI just needs to
+// know whether to offer the Users screen at all.
+const MANAGER_ROLES = ["admin", "superadmin"];
+
 // Admin gate for the UI. Driven by the full profile (fetched from /api/me),
 // which always reflects the current role from the DB — so a promotion/demotion
 // takes effect on the next profile refresh without needing a re-login.
 export const isAdmin = computed(
-  () => state.profile?.role === "admin" || state.user?.role === "admin"
+  () => MANAGER_ROLES.includes(state.profile?.role) || MANAGER_ROLES.includes(state.user?.role)
 );
 
 export async function login(email, password) {
+  // The API Server proxies login to PocketBase and relays its response
+  // verbatim, so the user is under `record` (PocketBase's name) and the token
+  // is PocketBase's own — this app no longer holds a server-minted JWT.
   const res = await api.login(email, password);
   state.token = res.token;
-  state.user = res.user;
+  state.user = res.record;
   localStorage.setItem(TOKEN_KEY, res.token);
-  localStorage.setItem(USER_KEY, JSON.stringify(res.user));
+  localStorage.setItem(USER_KEY, JSON.stringify(res.record));
   await refreshProfile();
   return res;
 }