PocketBase as a standalone database server

The pocketbase driver no longer embeds PocketBase: Warp keeps its data as
PocketBase collections on a server of its own and reaches it only through
the REST API, the way the postgres driver reaches PostgreSQL.
database.connection_string is the server's URL, and Warp signs in as the
superuser in WARP_PB_SUPERUSER_EMAIL / WARP_PB_SUPERUSER_PASSWORD (or a
WARP_PB_SUPERUSER_FILE of the two).

Every SQL table is a superuser-only collection of the same name and
columns, created by warp migrate. Reads go through PocketBase's SQL
endpoint with the SQL drivers' queries, via a read-only database/sql
driver that inlines arguments, moves long ones into warp_params and pages
past 1000 rows. Writes are record operations in batch requests under one
write lock in the Warp process. Media is a protected file field in
warp_media, local or in the S3 bucket Warp writes into PocketBase's
settings. Search matches word prefixes with LIKE. The storage tests run
against an in-process PocketBase and pass as on SQLite.

Docker: the PocketBase stacks get a pocketbase service running
tajniak81/pocketbase-docker-root (WARP_PB_IMAGE), with a pb-data volume
and its admin UI on loopback; the AIO images run that PocketBase binary
as a process beside the homeserver, making up a superuser when none is
set. The .env examples, READMEs, docs and warp.yaml.example follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/setup/phase10_test.go

@@ -10,21 +10,23 @@ import (
 	"time"
 
 	"github.com/dariuszjaniak/warp/server/internal/config"
+	"github.com/dariuszjaniak/warp/server/internal/storage/pocketbase/pbtest"
 )
 
 // The Phase 10 tests: the PocketBase driver and the new endpoints, through
 // the whole stack.
 
-// TestPocketBaseServer runs a server on the pocketbase driver: accounts,
-// rooms, search and media, with the media landing in PocketBase's own
-// filesystem rather than under media.base_path.
+// TestPocketBaseServer runs a server on the pocketbase driver, against a
+// PocketBase server of its own: accounts, rooms, search and media, with the
+// media landing in PocketBase's storage rather than under media.base_path.
 func TestPocketBaseServer(t *testing.T) {
-	dir := t.TempDir()
-	dataDir := filepath.Join(dir, "pb_data")
-	mediaDir := filepath.Join(dir, "media")
+	pb := pbtest.Start(t)
+	mediaDir := filepath.Join(t.TempDir(), "media")
 	srv := newSigningServer(t, func(cfg *config.Config) {
 		cfg.Database.Driver = "pocketbase"
-		cfg.Database.ConnectionString = dataDir
+		cfg.Database.ConnectionString = pb.URL
+		cfg.Database.PocketBase.SuperuserEmail = pbtest.SuperuserEmail
+		cfg.Database.PocketBase.SuperuserPassword = pbtest.SuperuserPassword
 		cfg.Registration.Enabled = true
 		cfg.ClientAPI.RateLimit.Enabled = false
 		cfg.Media.BasePath = mediaDir
@@ -63,7 +65,7 @@ func TestPocketBaseServer(t *testing.T) {
 	}
 
 	var found bool
-	_ = filepath.WalkDir(filepath.Join(dataDir, "storage", "warp_media"), func(_ string, d os.DirEntry, err error) error {
+	_ = filepath.WalkDir(filepath.Join(pb.DataDir, "storage"), func(_ string, d os.DirEntry, err error) error {
 		if err == nil && !d.IsDir() {
 			found = true
 		}