fix(auth): add Bearer prefix to PocketBase Authorization header

PocketBase v0.23+ requires 'Bearer <token>' — sending the raw JWT without
the prefix results in 403 'Only superusers can perform this action' on all
collection record endpoints. Fix applied in three places:
- ui/src/lib/server/pocketbase.ts (pbGet, pbPost, pbPatch helpers)
- scraper/internal/storage/pocketbase.go (pbClient.do)
- scripts/pb-init.sh (wget --header in create_collection)

ui/src/lib/server/pocketbase.ts

@@ -85,7 +85,7 @@ async function getToken(): Promise<string> {
 async function pbGet<T>(path: string): Promise<T> {
 	const token = await getToken();
 	const res = await fetch(`${PB_URL}${path}`, {
-		headers: { Authorization: token }
+		headers: { Authorization: `Bearer ${token}` }
 	});
 	if (!res.ok) {
 		const body = await res.text().catch(() => '');
@@ -99,7 +99,7 @@ async function pbPost(path: string, body: unknown): Promise<Response> {
 	const token = await getToken();
 	return fetch(`${PB_URL}${path}`, {
 		method: 'POST',
-		headers: { Authorization: token, 'Content-Type': 'application/json' },
+		headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
 		body: JSON.stringify(body)
 	});
 }
@@ -108,7 +108,7 @@ async function pbPatch(path: string, body: unknown): Promise<Response> {
 	const token = await getToken();
 	return fetch(`${PB_URL}${path}`, {
 		method: 'PATCH',
-		headers: { Authorization: token, 'Content-Type': 'application/json' },
+		headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
 		body: JSON.stringify(body)
 	});
 }