pb-config.js deliberately not copied — it hardcoded a PocketBase superuser email/password in client-shipped JS. Co-Authored-By: Claude <noreply@anthropic.com>