feat: replace Directus with custom Node.js GraphQL backend

Removes Directus 11 and replaces it with a lean, purpose-built backend:
- packages/backend/: Fastify v5 + GraphQL Yoga v5 + Pothos (code-first)
  with Drizzle ORM, Redis sessions (session_token cookie), argon2 auth,
  Nodemailer, fluent-ffmpeg, and full gamification system ported from bundle
- Frontend: @directus/sdk replaced by graphql-request v7; services.ts fully
  rewritten with identical signatures; directus.ts now re-exports from api.ts
- Cookie renamed directus_session_token → session_token
- Dev proxy target updated 8055 → 4000
- compose.yml: Directus service removed, backend service added (port 4000)
- Dockerfile.backend: new multi-stage image with ffmpeg
- Dockerfile: bundle build step and ffmpeg removed from frontend image
- data-migration.ts: one-time script to migrate all Directus/sexy_ tables

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compose.yml

@@ -27,54 +27,59 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
-  directus:
-    image: directus/directus:11
-    container_name: sexy_directus
+  backend:
+    build:
+      context: .
+      dockerfile: Dockerfile.backend
+    container_name: sexy_backend
     restart: unless-stopped
     ports:
-      - "8055:8055"
+      - "4000:4000"
     volumes:
-      - directus_uploads:/directus/uploads
-      - ./packages/bundle:/directus/extensions/sexy.pivoine.art
+      - uploads_data:/data/uploads
     environment:
-      DB_CLIENT: pg
-      DB_HOST: sexy_postgres
-      DB_PORT: 5432
-      DB_DATABASE: sexy
-      DB_USER: sexy
-      DB_PASSWORD: sexy
-      ADMIN_EMAIL: admin@sexy
-      ADMIN_PASSWORD: admin
-      PUBLIC_URL: http://localhost:3000/api
-      CACHE_ENABLED: true
-      CACHE_AUTO_PURGE: true
-      CACHE_STORE: redis
-      REDIS: redis://sexy_redis:6379
-      CORS_ENABLED: true
+      DATABASE_URL: postgresql://sexy:sexy@sexy_postgres:5432/sexy
+      REDIS_URL: redis://sexy_redis:6379
+      UPLOAD_DIR: /data/uploads
       CORS_ORIGIN: http://localhost:3000
-      SESSION_COOKIE_SECURE: false
-      SESSION_COOKIE_SAME_SITE: lax
-      SESSION_COOKIE_DOMAIN: localhost
-      EXTENSIONS_PATH: /directus/extensions
-      EXTENSIONS_AUTO_RELOAD: true
-      WEBSOCKETS_ENABLED: true
-      USER_REGISTER_URL_ALLOW_LIST: http://localhost:3000
-      PASSWORD_RESET_URL_ALLOW_LIST: http://localhost:3000
-      TZ: Europe/Amsterdam
+      PORT: 4000
+      NODE_ENV: production
+      COOKIE_SECRET: change-me-in-production
+      SMTP_HOST: localhost
+      SMTP_PORT: 587
+      EMAIL_FROM: noreply@sexy.pivoine.art
+      PUBLIC_URL: http://localhost:3000
     depends_on:
       postgres:
         condition: service_healthy
       redis:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8055/server/health"]
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:4000/health"]
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 40s
+      start_period: 20s
+  frontend:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: sexy_frontend
+    restart: unless-stopped
+    ports:
+      - "3000:3000"
+    environment:
+      NODE_ENV: production
+      PORT: 3000
+      HOST: 0.0.0.0
+      PUBLIC_API_URL: http://sexy_backend:4000
+      PUBLIC_URL: http://localhost:3000
+    depends_on:
+      backend:
+        condition: service_healthy
 
 volumes:
-  directus_uploads:
+  uploads_data:
     driver: local
   postgres_data:
     driver: local