Bring the Docker setup in line with DriverVault's

The combined stack now includes PocketBase as a first-class service instead
of assuming an external one: a Docker/pocketbase image built from the release
binary that bundles the pb_migrations and upserts the superuser on boot, so a
fresh stack checks/creates its collections and super-admin the same way
DriverVault does. Add production compose variants (registry images) and
.env(.prod).example files for both Docker/ and Docker AIO/, a top-level compose
name, a PocketBase healthcheck with a service_healthy dependency, and
env-driven ports. Move the containerized PocketBase to :8070 (the live remote
PB stays 10.2.1.10:8026). Add a root .dockerignore to trim the repo-root build
context used by the pocketbase and AIO images.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Docker/docker-compose.yml

@@ -1,40 +1,93 @@
-# Combined stack: API Server + Web App on a shared network.
-# Run from this Docker/ folder:  docker compose up --build
-# Build contexts point back up to each service directory.
+name: pilotvault
+
+# Combined PilotVault stack: PocketBase (database) + API Server + Web App, built
+# from source on a shared network. Run from this Docker/ folder:
+#
+#   cp .env.example .env   # then edit the secrets/ports
+#   docker compose up --build
+#
+# Traffic flow (browser): Web App BFF --/api--> API Server --> PocketBase.
+#
+# On first boot PocketBase upserts its superuser from POCKETBASE_ADMIN_* and runs
+# the bundled JS migrations, which create/reconcile every collection and seed the
+# baseline org + accounts (including the superadmin@pilotvault.local app login).
+# Every step is idempotent, so restarts and upgrades are safe.
 
 services:
+  pocketbase:
+    build:
+      # Repo root — the Dockerfile bundles the migrations from "API Server/".
+      context: ..
+      dockerfile: Docker/pocketbase/Dockerfile
+    image: pilotvault-pocketbase
+    container_name: pilotvault-pocketbase
+    restart: unless-stopped
+    environment:
+      # The superuser is created/updated on boot (the API Server authenticates
+      # with it). This is the only place the first superuser can be created — the
+      # REST API cannot bootstrap it.
+      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL:?set POCKETBASE_ADMIN_EMAIL in .env}"
+      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD:?set POCKETBASE_ADMIN_PASSWORD in .env}"
+    volumes:
+      # Named volume by default; set PB_DATA to a host path in .env for a bind mount.
+      - "${PB_DATA:-pb_data}:/pb/pb_data"
+    ports:
+      # Admin UI / API exposed on the host for management (http://host:8070/_/).
+      - "${PB_PORT:-8070}:8070"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health || exit 1"]
+      interval: 10s
+      timeout: 3s
+      retries: 12
+      start_period: 10s
+    networks:
+      - pilotvault
+
   api-server:
     build:
       context: "../API Server"
     image: pilotvault-api-server
     container_name: pilotvault-api-server
-    # Config (POCKETBASE_URL, CORS_ALLOW_ORIGINS, POCKETBASE_ADMIN_*) from .env.
-    env_file:
-      - "../API Server/.env"
+    restart: unless-stopped
+    depends_on:
+      pocketbase:
+        condition: service_healthy
+    environment:
+      API_ADDR: ":8080"
+      # Reach PocketBase by its service name on the shared network.
+      POCKETBASE_URL: "http://pocketbase:8070"
+      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
+      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
+      # Same-origin requests go through the Web App BFF, so CORS is only needed if
+      # a browser ever calls the API Server directly. Default to the web origin.
+      CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
     ports:
-      - "8080:8080"
+      # Optional direct access to the API Server (and its panel at /); the Web App
+      # reaches it over the internal network, not this host port.
+      - "${API_PORT:-8080}:8080"
     networks:
       - pilotvault
-    restart: unless-stopped
 
   web-app:
     build:
       context: "../Web App"
     image: pilotvault-web-app
     container_name: pilotvault-web-app
-    environment:
-      ADDR: ":8090"
-      # Reach the API Server by its service name on the shared network —
-      # no host.docker.internal needed here.
-      API_BASE: "http://api-server:8080"
-    ports:
-      - "8090:8090"
+    restart: unless-stopped
     depends_on:
       - api-server
+    environment:
+      ADDR: ":8090"
+      # The BFF reverse-proxies /api/* to the API Server over the shared network.
+      API_BASE: "http://api-server:8080"
+    ports:
+      - "${WEB_PORT:-8090}:8090"
     networks:
       - pilotvault
-    restart: unless-stopped
 
 networks:
   pilotvault:
     driver: bridge
+
+volumes:
+  pb_data: