feat: replace Directus with custom Node.js GraphQL backend

Removes Directus 11 and replaces it with a lean, purpose-built backend:
- packages/backend/: Fastify v5 + GraphQL Yoga v5 + Pothos (code-first)
  with Drizzle ORM, Redis sessions (session_token cookie), argon2 auth,
  Nodemailer, fluent-ffmpeg, and full gamification system ported from bundle
- Frontend: @directus/sdk replaced by graphql-request v7; services.ts fully
  rewritten with identical signatures; directus.ts now re-exports from api.ts
- Cookie renamed directus_session_token → session_token
- Dev proxy target updated 8055 → 4000
- compose.yml: Directus service removed, backend service added (port 4000)
- Dockerfile.backend: new multi-stage image with ffmpeg
- Dockerfile: bundle build step and ffmpeg removed from frontend image
- data-migration.ts: one-time script to migrate all Directus/sexy_ tables

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/backend/src/db/schema/users.ts

@@ -0,0 +1,60 @@
+import {
+  pgTable,
+  text,
+  timestamp,
+  pgEnum,
+  boolean,
+  index,
+  uniqueIndex,
+  integer,
+} from "drizzle-orm/pg-core";
+import { files } from "./files.js";
+
+export const roleEnum = pgEnum("user_role", ["model", "viewer", "admin"]);
+
+export const users = pgTable(
+  "users",
+  {
+    id: text("id").primaryKey().$defaultFn(() => crypto.randomUUID()),
+    email: text("email").notNull(),
+    password_hash: text("password_hash").notNull(),
+    first_name: text("first_name"),
+    last_name: text("last_name"),
+    artist_name: text("artist_name"),
+    slug: text("slug"),
+    description: text("description"),
+    tags: text("tags").array().default([]),
+    role: roleEnum("role").notNull().default("viewer"),
+    avatar: text("avatar").references(() => files.id, { onDelete: "set null" }),
+    banner: text("banner").references(() => files.id, { onDelete: "set null" }),
+    email_verified: boolean("email_verified").notNull().default(false),
+    email_verify_token: text("email_verify_token"),
+    password_reset_token: text("password_reset_token"),
+    password_reset_expiry: timestamp("password_reset_expiry"),
+    date_created: timestamp("date_created").notNull().defaultNow(),
+    date_updated: timestamp("date_updated"),
+  },
+  (t) => [
+    uniqueIndex("users_email_idx").on(t.email),
+    uniqueIndex("users_slug_idx").on(t.slug),
+    index("users_role_idx").on(t.role),
+  ],
+);
+
+export const user_photos = pgTable(
+  "user_photos",
+  {
+    id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+    user_id: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    file_id: text("file_id")
+      .notNull()
+      .references(() => files.id, { onDelete: "cascade" }),
+    sort: integer("sort").default(0),
+  },
+  (t) => [index("user_photos_user_idx").on(t.user_id)],
+);
+
+export type User = typeof users.$inferSelect;
+export type NewUser = typeof users.$inferInsert;