Plugins: drop the plugins.json migration, and the volume it needed

The project has no public installs, so there is nothing to migrate from.
MigrateLegacyFile, the file-backed Store it read through, PLUGINS_FILE and
the legacy path threaded through the Server all go. What is left is one
store, PocketBase, and a plugins package that touches no filesystem at all.

That was the last thing keeping api_data alive, so the volume goes too. All
four compose files now declare exactly one volume, pb_data, and the
standalone API Server compose declares none - it talks to an external
PocketBase and has nothing of its own to keep. Backing up the stack is
backing up one path again.

Both images get simpler for it. The API Server image loses VOLUME /data and
the su-exec entrypoint that existed only to fix a mounted volume's
ownership, so it goes back to a plain USER app; its working directory is
now /app and holds nothing. The AIO image loses its second volume and
chowns only /pb/pb_data.

One consequence worth stating plainly, because it is a small regression
rather than a no-op. The panel's Settings -> PocketBase and Settings -> Web
App screens write .env in the working directory, which is now ephemeral. In
the multi-container stack that changes nothing: compose sets all five of
those keys as container environment, and loadDotEnv only applies a key that
is not already set, so the file could never win a restart there anyway. In
the AIO image it did win for POCKETBASE_ADMIN_EMAIL/_PASSWORD, which are
not in that container's environment - so a service account fixed from the
panel now lasts only until the container is recreated. Both READMEs say so.
Moving those two screens into the app_settings singleton would close it
properly; the PocketBase URL and credentials cannot follow, since they are
how the database is reached in the first place.

go build, go vet and go test ./... pass; the compose files parse and each
resolves to a single pb_data volume. Not verified: no Docker CLI here, so
neither image was built.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

API Server/README.md

@@ -318,7 +318,6 @@ Copy `.env.example` to `.env` and fill in. Summary:
 | `CORS_ALLOW_ORIGINS` | `*` | comma-separated browser origins |
 | `WEBAPP_URL` | `http://localhost:8090` | probed by `/api/status` |
 | `AUTH_USERS_COLLECTION` | `users` | PocketBase auth collection |
-| `PLUGINS_FILE` | `plugins.json` | legacy plugin store, imported once then renamed |
 | `OCPP_REQUIRE_TLS` | `true` | reject chargers that did not connect over TLS |
 | `OCPP_PUBLIC_URL` | — | canonical `ws(s)://` base to point chargers at |
 | `PB_BOOTSTRAP` | `true` | run the on-boot schema create/reconcile (leave on across upgrades) |
@@ -327,12 +326,13 @@ Copy `.env.example` to `.env` and fill in. Summary:
 `PB_URL`, `PB_ADMIN_EMAIL`, `PB_ADMIN_PASSWORD`, `PORT` and `CORS_ORIGINS` are
 still honoured for older deployments; the modern names win when both are set.
 
-Two paths are resolved **relative to the working directory**: the `.env` the
-panel rewrites when a superadmin retargets PocketBase, and `PLUGINS_FILE` (read
-once, to import a pre-PocketBase plugin store). In Docker the working directory
-is `/data`, a volume, so the `.env` survives a container recreate — see
-[`Dockerfile`](Dockerfile) and [`../Docker`](../Docker). Plugin settings no
-longer depend on that volume: they live in the database with everything else.
+The server keeps **no state on disk**: plugin settings, like everything else it
+owns, live in PocketBase. A `.env` in the working directory is read at startup as
+a local-development convenience, and the panel writes back to it when a
+superadmin retargets PocketBase or the Web App — but in Docker there is no volume
+behind it, so those two screens apply for the life of the container only. Set the
+environment variables to change them permanently; see [`Dockerfile`](Dockerfile)
+and [`../Docker`](../Docker).
 
 `CORS_ALLOW_ORIGINS` only matters for **browser** clients (the web app). Native
 mobile apps are not subject to CORS.