fix(auth): add Bearer prefix to PocketBase Authorization header

PocketBase v0.23+ requires 'Bearer <token>' — sending the raw JWT without
the prefix results in 403 'Only superusers can perform this action' on all
collection record endpoints. Fix applied in three places:
- ui/src/lib/server/pocketbase.ts (pbGet, pbPost, pbPatch helpers)
- scraper/internal/storage/pocketbase.go (pbClient.do)
- scripts/pb-init.sh (wget --header in create_collection)

scraper/internal/storage/pocketbase.go

@@ -119,7 +119,7 @@ func (p *pbClient) do(ctx context.Context, method, path string, body interface{}
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", tok)
+	req.Header.Set("Authorization", "Bearer "+tok)
 	if body != nil {
 		req.Header.Set("Content-Type", "application/json")
 	}

scripts/pb-init.sh

@@ -44,7 +44,7 @@ create_collection() {
   BODY="$2"
   STATUS=$(wget -qSO- \
     --header="Content-Type: application/json" \
-    --header="Authorization: $TOKEN" \
+    --header="Authorization: Bearer $TOKEN" \
     --post-data="$BODY" \
     "$PB_URL/api/collections" 2>&1 | grep "HTTP/" | tail -1 | awk '{print $2}')
   case "$STATUS" in

ui/src/lib/server/pocketbase.ts

@@ -85,7 +85,7 @@ async function getToken(): Promise<string> {
 async function pbGet<T>(path: string): Promise<T> {
 	const token = await getToken();
 	const res = await fetch(`${PB_URL}${path}`, {
-		headers: { Authorization: token }
+		headers: { Authorization: `Bearer ${token}` }
 	});
 	if (!res.ok) {
 		const body = await res.text().catch(() => '');
@@ -99,7 +99,7 @@ async function pbPost(path: string, body: unknown): Promise<Response> {
 	const token = await getToken();
 	return fetch(`${PB_URL}${path}`, {
 		method: 'POST',
-		headers: { Authorization: token, 'Content-Type': 'application/json' },
+		headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
 		body: JSON.stringify(body)
 	});
 }
@@ -108,7 +108,7 @@ async function pbPatch(path: string, body: unknown): Promise<Response> {
 	const token = await getToken();
 	return fetch(`${PB_URL}${path}`, {
 		method: 'PATCH',
-		headers: { Authorization: token, 'Content-Type': 'application/json' },
+		headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
 		body: JSON.stringify(body)
 	});
 }