feat: migrate from JSON files to PocketBase public API (#510)

* feat: migrate from JSON files to PocketBase public API

- Remove all community JSON files from json/ folder (folder kept for user scripts)
- Add pocketbase npm package
- Add pbService.ts: PocketBase singleton client (unauthenticated)
- Add pbScripts.ts: PocketBase queries mirroring the website's API
- Update localScripts.ts: use PocketBase as primary source, local JSON as fallback
- Rewrite scripts.ts router: all data fetching via PocketBase
- Update scriptDownloader.js: derive script paths by convention (type+slug)
  instead of relying on explicit JSON paths
- Update autoSyncService.js: fetch scripts from PocketBase instead of JSON files
- Update env.js: add PB_URL, remove JSON_FOLDER requirement
- Update .env.example: document new PB_URL variable

* fix: correct PocketBase URL to db.community-scripts.org

* fix: downgrade @vitejs/plugin-react to ^5 (compatible with vitest@4/vite@6), add .npmrc

* fix: resolve all npm audit vulnerabilities via overrides

- @hono/node-server: >=1.19.10 (authorization bypass fix)
- lodash: ^4.17.23 (prototype pollution fix)
All vulns were transitive deps of prisma CLI internals (@prisma/dev)

* fix: remove .js extensions from TS imports for webpack compatibility

* fix: remove 'source' from ScriptCard literal, fix pbScripts import extension

* fix: restore repository_url as optional in ScriptCard, remove dead repo filters

* fix: resolve all remaining build errors

- resyncScripts: add error field to return type
- ScriptsGrid.tsx: remove 'source' from ScriptCard literal
- autoSyncService.js: add JSDoc types for implicit any params
- githubJsonService.ts: use process.env.JSON_FOLDER directly
- localScripts.ts: fix PB->Script mapping (interface_port, default_credentials,
  date_created, logo as null); add website field to getScriptCards()

* fix: use dbUrl fallback for Prisma adapter and align default DB path with prisma.config.ts

- db.ts / db.js: use dbUrl variable (with fallback to pve-scripts.db) instead
  of process.env.DATABASE_URL! directly, prevents crash when DATABASE_URL is
  not set in environment
- autoSyncService.js: suppress ENOENT error log in loadSettings when .env file
  does not exist (return defaults silently instead of printing error)

* fix: align .env.example DATABASE_URL db filename with prisma.config.ts default

Author: MickLesk

.env.example

@@ -1,15 +1,15 @@
 # When adding additional environment variables, the schema in "/src/env.js"
 # should be updated accordingly.
 
+# PocketBase - public API for script metadata (mirrors the community website)
+PB_URL="https://db.community-scripts.org"
+
+# Repository - used for downloading actual .sh script files
 REPO_URL="https://github.com/community-scripts/ProxmoxVE"
 REPO_BRANCH="main"
 SCRIPTS_DIRECTORY="scripts"
 ALLOWED_SCRIPT_EXTENSIONS=".sh"
 
-CT_SCRIPT_FOLDER="ct"
-INSTALL_SCRIPT_FOLDER="install"
-JSON_FOLDER="frontend/public/json"
-
 # Security
 MAX_SCRIPT_EXECUTION_TIME="900000"
 ALLOWED_SCRIPT_PATHS="scripts/"
@@ -31,7 +31,7 @@ AUTH_PASSWORD_HASH=
 AUTH_ENABLED=false
 AUTH_SETUP_COMPLETED=false
 JWT_SECRET=
-DATABASE_URL="file:/opt/ProxmoxVE-Local/data/settings.db"
+DATABASE_URL="file:/opt/ProxmoxVE-Local/data/pve-scripts.db"
 AUTO_SYNC_ENABLED=false
 SYNC_INTERVAL_TYPE=
 SYNC_INTERVAL_PREDEFINED=

.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true