feat: replace pb-init-v3.sh with PocketBase Go migrations

Adds a custom PocketBase binary (cmd/pocketbase) that embeds PocketBase as a
Go framework with version-controlled migrations, replacing the fragile 419-line
shell script. Migrations apply automatically on every `serve` startup.

Migration 1 (20260414000001): full baseline schema — all 21 collections, both
  indexes on chapters_idx, and initial superuser creation from env vars.
Migration 2 (20260414000002): adds three fields found in code but missing from
  the old script — books.rating, app_users.notify_new_chapters_push,
  book_comments.chapter.

docker-compose: pocketbase service now uses the custom kalekber/libnovel-pocketbase
image; pb-init one-shot container removed (migrations replace it entirely).

Existing installs: run `migrate history-sync` once to mark migration 1 as done,
then restart — migration 2 will apply the three previously missing fields.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -67,12 +67,21 @@ services:
       MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD}"
 
   # ─── PocketBase (auth + structured data) ─────────────────────────────────────
+  # Custom binary built from backend/cmd/pocketbase — runs Go migrations on every
+  # startup before accepting traffic, replacing the old pb-init-v3.sh script.
   pocketbase:
-    image: ghcr.io/muchobien/pocketbase:latest
+    image: kalekber/libnovel-pocketbase:${GIT_TAG:-latest}
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+      target: pocketbase
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
     restart: unless-stopped
     environment:
-      PB_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
-      PB_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
+      # Used by migration 1 to create the initial superuser on a fresh install.
+      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
+      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
     # No public port — accessed only by backend/runner on the internal network.
     expose:
       - "8090"
@@ -84,20 +93,6 @@ services:
       timeout: 5s
       retries: 5
 
-  # ─── PocketBase collection bootstrap ─────────────────────────────────────────
-  pb-init:
-    image: alpine:3.19
-    depends_on:
-      pocketbase:
-        condition: service_healthy
-    environment:
-      POCKETBASE_URL: "http://pocketbase:8090"
-      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
-      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
-    volumes:
-      - ./scripts/pb-init-v3.sh:/pb-init.sh:ro
-    entrypoint: ["sh", "/pb-init.sh"]
-
   # ─── Meilisearch (full-text search) ──────────────────────────────────────────
   meilisearch:
     image: getmeili/meilisearch:latest
@@ -166,8 +161,6 @@ services:
     restart: unless-stopped
     stop_grace_period: 35s
     depends_on:
-      pb-init:
-        condition: service_completed_successfully
       pocketbase:
         condition: service_healthy
       minio:
@@ -221,8 +214,6 @@ services:
     restart: unless-stopped
     stop_grace_period: 135s
     depends_on:
-      pb-init:
-        condition: service_completed_successfully
       pocketbase:
         condition: service_healthy
       minio:
@@ -276,8 +267,6 @@ services:
     restart: unless-stopped
     stop_grace_period: 35s
     depends_on:
-      pb-init:
-        condition: service_completed_successfully
       backend:
         condition: service_healthy
       pocketbase: