PocketBase as a standalone database server

The pocketbase driver no longer embeds PocketBase: Warp keeps its data as
PocketBase collections on a server of its own and reaches it only through
the REST API, the way the postgres driver reaches PostgreSQL.
database.connection_string is the server's URL, and Warp signs in as the
superuser in WARP_PB_SUPERUSER_EMAIL / WARP_PB_SUPERUSER_PASSWORD (or a
WARP_PB_SUPERUSER_FILE of the two).

Every SQL table is a superuser-only collection of the same name and
columns, created by warp migrate. Reads go through PocketBase's SQL
endpoint with the SQL drivers' queries, via a read-only database/sql
driver that inlines arguments, moves long ones into warp_params and pages
past 1000 rows. Writes are record operations in batch requests under one
write lock in the Warp process. Media is a protected file field in
warp_media, local or in the S3 bucket Warp writes into PocketBase's
settings. Search matches word prefixes with LIKE. The storage tests run
against an in-process PocketBase and pass as on SQLite.

Docker: the PocketBase stacks get a pocketbase service running
tajniak81/pocketbase-docker-root (WARP_PB_IMAGE), with a pb-data volume
and its admin UI on loopback; the AIO images run that PocketBase binary
as a process beside the homeserver, making up a superuser when none is
set. The .env examples, READMEs, docs and warp.yaml.example follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker-AIO/Dockerfile.PocketBase.SeaweedFS

@@ -1,7 +1,8 @@
 # warp-aio-pocketbase-seaweedfs — the homeserver, the admin panel and the
 # web client on PocketBase, with SeaweedFS in the same image as the media
 # store: one `weed server -s3` process, master, volume, filer and S3 gateway
-# in one. The homeserver keeps its database in /data/pb_data and its media
+# in one. PocketBase runs beside the homeserver, its database in
+# /data/pb_data; the homeserver keeps its media
 # in the bucket WARP_PB_S3_BUCKET (default warp) on the gateway at
 # 127.0.0.1:8333. For per-role processes and SeaweedFS's admin UI, see
 # Dockerfile.PocketBase.SeaweedFS.split.
@@ -31,6 +32,10 @@
 # it.
 ARG SEAWEED_VERSION="4.45"
 
+# PocketBase itself: the binary of this image, PocketBase 0.40 or later.
+ARG PB_IMAGE=tajniak81/pocketbase-docker-root:latest
+FROM ${PB_IMAGE} AS pocketbase
+
 FROM node:22-alpine AS web
 
 WORKDIR /src
@@ -98,6 +103,8 @@ RUN apk add --no-cache ca-certificates tzdata curl tini && \
     adduser -D -u 10001 -h /data warp
 
 COPY --from=build /out/warp /out/warp-admin /out/warp-web /usr/local/bin/
+# PocketBase, from the same image the separate-container stacks run.
+COPY --from=pocketbase /pb/pocketbase /usr/local/bin/pocketbase
 COPY --from=seaweed /usr/bin/weed /usr/local/bin/weed
 COPY warp.yaml.example /etc/warp/warp.yaml.example
 COPY --chmod=755 Docker-AIO/entrypoint.sh /usr/local/bin/warp-aio
@@ -116,7 +123,7 @@ USER warp
 ENV WARP_LISTEN_ADDRESS=":8008" \
     WARP_PRIVATE_KEY="/data/signing.key" \
     WARP_DB_DRIVER="pocketbase" \
-    WARP_DB_CONNECTION_STRING="/data/pb_data" \
+    WARP_DB_CONNECTION_STRING="http://127.0.0.1:8070" \
     WARP_PB_S3_ENABLED="true" \
     WARP_PB_S3_ENDPOINT="http://127.0.0.1:8333" \
     WARP_PB_S3_BUCKET="warp" \
@@ -131,10 +138,12 @@ ENV WARP_LISTEN_ADDRESS=":8008" \
     WARP_WEB_LOG_FORMAT="json" \
     WARP_AIO_ADMIN="true" \
     WARP_AIO_WEB="true" \
+    WARP_AIO_POCKETBASE="true" \
+    WARP_PB_SUPERUSER_FILE="/data/pocketbase-superuser.env" \
     WARP_AIO_EMBEDDED_POSTGRES="false" \
     WARP_AIO_SEAWEEDFS="server"
 
-EXPOSE 8008 8009 8080 8333
+EXPOSE 8008 8009 8080 8070 8333
 
 # Every process must answer, so a wedged one shows in `docker ps`.
 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \