feat: replace Directus with custom Node.js GraphQL backend

Removes Directus 11 and replaces it with a lean, purpose-built backend:
- packages/backend/: Fastify v5 + GraphQL Yoga v5 + Pothos (code-first)
  with Drizzle ORM, Redis sessions (session_token cookie), argon2 auth,
  Nodemailer, fluent-ffmpeg, and full gamification system ported from bundle
- Frontend: @directus/sdk replaced by graphql-request v7; services.ts fully
  rewritten with identical signatures; directus.ts now re-exports from api.ts
- Cookie renamed directus_session_token → session_token
- Dev proxy target updated 8055 → 4000
- compose.yml: Directus service removed, backend service added (port 4000)
- Dockerfile.backend: new multi-stage image with ffmpeg
- Dockerfile: bundle build step and ffmpeg removed from frontend image
- data-migration.ts: one-time script to migrate all Directus/sexy_ tables

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/backend/src/graphql/resolvers/users.ts

@@ -0,0 +1,72 @@
+import { GraphQLError } from "graphql";
+import { builder } from "../builder.js";
+import { CurrentUserType, UserType } from "../types/index.js";
+import { users } from "../../db/schema/index.js";
+import { eq } from "drizzle-orm";
+
+builder.queryField("me", (t) =>
+  t.field({
+    type: CurrentUserType,
+    nullable: true,
+    resolve: async (_root, _args, ctx) => {
+      if (!ctx.currentUser) return null;
+      const user = await ctx.db
+        .select()
+        .from(users)
+        .where(eq(users.id, ctx.currentUser.id))
+        .limit(1);
+      return user[0] || null;
+    },
+  }),
+);
+
+builder.queryField("userProfile", (t) =>
+  t.field({
+    type: UserType,
+    nullable: true,
+    args: {
+      id: t.arg.string({ required: true }),
+    },
+    resolve: async (_root, args, ctx) => {
+      const user = await ctx.db
+        .select()
+        .from(users)
+        .where(eq(users.id, args.id))
+        .limit(1);
+      return user[0] || null;
+    },
+  }),
+);
+
+builder.mutationField("updateProfile", (t) =>
+  t.field({
+    type: CurrentUserType,
+    nullable: true,
+    args: {
+      firstName: t.arg.string(),
+      lastName: t.arg.string(),
+      artistName: t.arg.string(),
+      description: t.arg.string(),
+      tags: t.arg.stringList(),
+    },
+    resolve: async (_root, args, ctx) => {
+      if (!ctx.currentUser) throw new GraphQLError("Unauthorized");
+
+      const updates: Record<string, unknown> = { date_updated: new Date() };
+      if (args.firstName !== undefined && args.firstName !== null) updates.first_name = args.firstName;
+      if (args.lastName !== undefined && args.lastName !== null) updates.last_name = args.lastName;
+      if (args.artistName !== undefined && args.artistName !== null) updates.artist_name = args.artistName;
+      if (args.description !== undefined && args.description !== null) updates.description = args.description;
+      if (args.tags !== undefined && args.tags !== null) updates.tags = args.tags;
+
+      await ctx.db.update(users).set(updates as any).where(eq(users.id, ctx.currentUser.id));
+
+      const updated = await ctx.db
+        .select()
+        .from(users)
+        .where(eq(users.id, ctx.currentUser.id))
+        .limit(1);
+      return updated[0] || null;
+    },
+  }),
+);