fix(auth): update PocketBase v0.23+ auth endpoint and rename users collection

- Replace deprecated /api/admins/auth-with-password with
  /api/collections/_superusers/auth-with-password in both the
  SvelteKit UI (pocketbase.ts) and Go scraper (pocketbase.go)
- Rename custom users collection to app_users to avoid name clash
  with PocketBase's built-in users auth collection
- Fix docker-compose volume mount path pb/pb_data -> pb_data so
  persisted data matches the entrypoint --dir flag
- Add PB_ADMIN_EMAIL/PB_ADMIN_PASSWORD env vars to pocketbase service
  so the superuser is auto-created on first boot

ui/src/lib/server/pocketbase.ts

@@ -61,7 +61,7 @@ async function getToken(): Promise<string> {
 
 	log.debug('pocketbase', 'authenticating with admin credentials', { url: PB_URL, email: PB_EMAIL });
 
-	const res = await fetch(`${PB_URL}/api/admins/auth-with-password`, {
+	const res = await fetch(`${PB_URL}/api/collections/_superusers/auth-with-password`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
 		body: JSON.stringify({ identity: PB_EMAIL, password: PB_PASSWORD })
@@ -213,7 +213,7 @@ function verifyPassword(password: string, stored: string): boolean {
  * Look up a user by username. Returns null if not found.
  */
 export async function getUserByUsername(username: string): Promise<User | null> {
-	return listOne<User>('users', `username="${username.replace(/"/g, '\\"')}"`);
+	return listOne<User>('app_users', `username="${username.replace(/"/g, '\\"')}"`);
 }
 
 /**
@@ -228,7 +228,7 @@ export async function createUser(username: string, password: string, role = 'use
 	}
 	const password_hash = hashPassword(password);
 	log.info('pocketbase', 'createUser: inserting new user', { username, role });
-	const res = await pbPost('/api/collections/users/records', {
+	const res = await pbPost('/api/collections/app_users/records', {
 		username,
 		password_hash,
 		role,