Bring the Docker setup in line with DriverVault's

The combined stack now includes PocketBase as a first-class service instead
of assuming an external one: a Docker/pocketbase image built from the release
binary that bundles the pb_migrations and upserts the superuser on boot, so a
fresh stack checks/creates its collections and super-admin the same way
DriverVault does. Add production compose variants (registry images) and
.env(.prod).example files for both Docker/ and Docker AIO/, a top-level compose
name, a PocketBase healthcheck with a service_healthy dependency, and
env-driven ports. Move the containerized PocketBase to :8070 (the live remote
PB stays 10.2.1.10:8026). Add a root .dockerignore to trim the repo-root build
context used by the pocketbase and AIO images.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Docker/pocketbase/Dockerfile

@@ -0,0 +1,44 @@
+# syntax=docker/dockerfile:1
+#
+# PocketBase for PilotVault, built from the official release binary on alpine.
+#
+# It bundles the JS migrations from "API Server/pocketbase/pb_migrations" so that
+# on first serve PocketBase creates/reconciles every collection and seeds the
+# baseline organization + accounts (including the superadmin@pilotvault.local app
+# login). Together with the `superuser upsert` in the entrypoint, THIS is where
+# PilotVault "checks" that the schema and the super-admin exist — all idempotent,
+# so restarts and upgrades are safe.
+#
+# BUILD CONTEXT IS THE REPO ROOT (the migrations live under "API Server/"). It is
+# built for you by Docker/docker-compose.yml; to build it by hand run from
+# E:\VS Code Projects\PilotVault:
+#
+#   docker build -f Docker/pocketbase/Dockerfile -t pilotvault-pocketbase .
+
+FROM alpine:latest
+
+# Pin the version to match the rest of PilotVault; override with --build-arg.
+# PB_ARCH is "amd64" (default) or "arm64" (e.g. Apple Silicon).
+ARG PB_VERSION=0.22.21
+ARG PB_ARCH=amd64
+
+RUN apk add --no-cache ca-certificates tzdata unzip wget
+
+WORKDIR /pb
+RUN set -eux; \
+    wget -q -O /tmp/pb.zip \
+      "https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${PB_ARCH}.zip"; \
+    unzip /tmp/pb.zip -d /pb; \
+    rm /tmp/pb.zip
+
+# Schema + seed migrations (single source of truth in the API Server tree).
+COPY ["API Server/pocketbase/pb_migrations/", "/pb/pb_migrations/"]
+
+COPY ["Docker/pocketbase/entrypoint.sh", "/entrypoint.sh"]
+RUN chmod +x /entrypoint.sh
+
+# pb_data holds the SQLite database and uploads — mount a volume here.
+VOLUME ["/pb/pb_data"]
+EXPOSE 8070
+
+ENTRYPOINT ["/entrypoint.sh"]

Docker/pocketbase/entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+# Create/update the superuser from env vars so the API Server can authenticate on
+# first boot. `superuser upsert` is idempotent (PocketBase v0.22+/v0.23). Accepts
+# either the PilotVault names (POCKETBASE_ADMIN_*) or the short PB_ADMIN_* aliases.
+ADMIN_EMAIL="${POCKETBASE_ADMIN_EMAIL:-$PB_ADMIN_EMAIL}"
+ADMIN_PASSWORD="${POCKETBASE_ADMIN_PASSWORD:-$PB_ADMIN_PASSWORD}"
+
+if [ -n "$ADMIN_EMAIL" ] && [ -n "$ADMIN_PASSWORD" ]; then
+  echo "Ensuring PocketBase superuser $ADMIN_EMAIL exists..."
+  /pb/pocketbase superuser upsert "$ADMIN_EMAIL" "$ADMIN_PASSWORD" \
+    || echo "warning: superuser upsert failed; create an admin via the UI at /_/"
+fi
+
+# Serve. --migrationsDir applies the bundled JS migrations on boot, which
+# create/reconcile every collection and seed the baseline org + accounts
+# (including superadmin@pilotvault.local) — all idempotent.
+exec /pb/pocketbase serve --http=0.0.0.0:8070 --migrationsDir=/pb/pb_migrations