feat: replace Directus with custom Node.js GraphQL backend

Removes Directus 11 and replaces it with a lean, purpose-built backend:
- packages/backend/: Fastify v5 + GraphQL Yoga v5 + Pothos (code-first)
  with Drizzle ORM, Redis sessions (session_token cookie), argon2 auth,
  Nodemailer, fluent-ffmpeg, and full gamification system ported from bundle
- Frontend: @directus/sdk replaced by graphql-request v7; services.ts fully
  rewritten with identical signatures; directus.ts now re-exports from api.ts
- Cookie renamed directus_session_token → session_token
- Dev proxy target updated 8055 → 4000
- compose.yml: Directus service removed, backend service added (port 4000)
- Dockerfile.backend: new multi-stage image with ffmpeg
- Dockerfile: bundle build step and ffmpeg removed from frontend image
- data-migration.ts: one-time script to migrate all Directus/sexy_ tables

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/backend/src/graphql/resolvers/comments.ts

@@ -0,0 +1,68 @@
+import { GraphQLError } from "graphql";
+import { builder } from "../builder.js";
+import { CommentType } from "../types/index.js";
+import { comments, users } from "../../db/schema/index.js";
+import { eq, and, desc } from "drizzle-orm";
+import { awardPoints, checkAchievements } from "../../lib/gamification.js";
+
+builder.queryField("commentsForVideo", (t) =>
+  t.field({
+    type: [CommentType],
+    args: {
+      videoId: t.arg.string({ required: true }),
+    },
+    resolve: async (_root, args, ctx) => {
+      const commentList = await ctx.db
+        .select()
+        .from(comments)
+        .where(and(eq(comments.collection, "videos"), eq(comments.item_id, args.videoId)))
+        .orderBy(desc(comments.date_created));
+
+      return Promise.all(
+        commentList.map(async (c: any) => {
+          const user = await ctx.db
+            .select({ id: users.id, first_name: users.first_name, last_name: users.last_name, avatar: users.avatar })
+            .from(users)
+            .where(eq(users.id, c.user_id))
+            .limit(1);
+          return { ...c, user: user[0] || null };
+        }),
+      );
+    },
+  }),
+);
+
+builder.mutationField("createCommentForVideo", (t) =>
+  t.field({
+    type: CommentType,
+    args: {
+      videoId: t.arg.string({ required: true }),
+      comment: t.arg.string({ required: true }),
+    },
+    resolve: async (_root, args, ctx) => {
+      if (!ctx.currentUser) throw new GraphQLError("Unauthorized");
+
+      const newComment = await ctx.db
+        .insert(comments)
+        .values({
+          collection: "videos",
+          item_id: args.videoId,
+          comment: args.comment,
+          user_id: ctx.currentUser.id,
+        })
+        .returning();
+
+      // Gamification
+      await awardPoints(ctx.db, ctx.currentUser.id, "COMMENT_CREATE");
+      await checkAchievements(ctx.db, ctx.currentUser.id, "social");
+
+      const user = await ctx.db
+        .select({ id: users.id, first_name: users.first_name, last_name: users.last_name, avatar: users.avatar })
+        .from(users)
+        .where(eq(users.id, ctx.currentUser.id))
+        .limit(1);
+
+      return { ...newComment[0], user: user[0] || null };
+    },
+  }),
+);