Wanderer: add pocketbase CLI wrapper with env

Fixes #13858

Running pocketbase commands manually (e.g. superuser upsert) fails
because POCKETBASE_ENCRYPTION_KEY is only loaded via systemd env.
Add /usr/local/bin/wanderer-pb wrapper that sources .env before
executing pocketbase.

install/wanderer-install.sh

@@ -60,6 +60,16 @@ wait -n
 EOF
 chmod +x /opt/wanderer/start.sh
 
+cat <<'EOF' >/usr/local/bin/wanderer-pb
+#!/usr/bin/env bash
+set -a
+source /opt/wanderer/.env
+set +a
+cd /opt/wanderer/source/db
+exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
+EOF
+chmod +x /usr/local/bin/wanderer-pb
+
 cat <<EOF >/etc/systemd/system/wanderer-web.service
 [Unit]
 Description=wanderer