Replace Strapi CMS with PocketBase

Strapi + Postgres are gone in favor of PocketBase: a single Go binary
with embedded SQLite, built-in admin UI and per-collection API rules.
No content existed yet, so this is a clean swap with no data migration.

Collections and rules are defined as code in pocketbase/pb_migrations/
and applied automatically on first boot. Draft & Publish has no native
PocketBase equivalent, so it's reproduced with a nullable `publishedAt`
field enforced by listRule/viewRule, matching the old Strapi semantics.

Routing flips: PocketBase's admin UI and REST/file API are hardwired to
`/_/` and `/api/*` at the domain root (its own dashboard assets and API
calls reference those paths directly, so a stripped path prefix like
`/admin/*` would break them). `/api` is therefore reserved for
PocketBase now, and the frontend's Nitro endpoints move to `/content/*`
(frontend/server/routes/content/, not server/api/). A `/admin` vanity
route in Nitro (not Caddy) redirects to `/_/`, so it works the same in
dev, where Caddy isn't part of the stack, and in production.

frontend/server/utils/strapi.ts becomes pocketbase.ts; queries.ts is
rewritten for PocketBase's filter/sort/fields/expand query syntax.
StrapiImage becomes MediaImage (no width/height — PocketBase file
fields don't store dimensions, and the cover images already reserve
their aspect ratio via CSS, so this is not a regression).

docs/*.md, CLAUDE.md and README.md are updated in the same commit.

.env.example

@@ -4,25 +4,20 @@
 PUBLIC_DOMAIN=blog.localhost
 ACME_EMAIL=admin@example.com
 
-# --- Database ---
-POSTGRES_DB=blog
-POSTGRES_USER=blog
-POSTGRES_PASSWORD=change-me
-
-# --- Strapi ---
-# Generate each secret with: openssl rand -base64 32
-APP_KEYS=change-me-1,change-me-2
-API_TOKEN_SALT=change-me
-ADMIN_JWT_SECRET=change-me
-TRANSFER_TOKEN_SALT=change-me
-JWT_SECRET=change-me
-ENCRYPTION_KEY=change-me
+# --- PocketBase ---
+# Bootstraps (or updates, on restart) the initial superuser account — the
+# only login the admin UI accepts. Pick a real password (10+ chars); never
+# committed as anything but this placeholder.
+POCKETBASE_ADMIN_EMAIL=admin@example.com
+POCKETBASE_ADMIN_PASSWORD=change-me-1234
 
 # --- Frontend ---
-# Server-side only: internal Docker address of Strapi.
-STRAPI_URL=http://cms:1337
+# Server-side only: internal Docker address of PocketBase.
+POCKETBASE_URL=http://pocketbase:8090
 # Public base URL of the website, used for canonical URLs and Open Graph.
 PUBLIC_SITE_URL=https://blog.localhost
-# Public base URL of Strapi, used to build absolute media URLs in the browser.
-# Same origin as PUBLIC_SITE_URL: Caddy proxies /admin and /uploads to Strapi.
-PUBLIC_STRAPI_URL=https://blog.localhost
+# Public base URL of PocketBase, used to build absolute cover-image URLs.
+# Same origin as PUBLIC_SITE_URL: Caddy proxies /_/* and /api/* there (the
+# admin UI is at PUBLIC_POCKETBASE_URL/_/, reachable from PUBLIC_SITE_URL/admin
+# too — see caddy/Caddyfile).
+PUBLIC_POCKETBASE_URL=https://blog.localhost