feat: replace Directus with custom Node.js GraphQL backend

Removes Directus 11 and replaces it with a lean, purpose-built backend:
- packages/backend/: Fastify v5 + GraphQL Yoga v5 + Pothos (code-first)
  with Drizzle ORM, Redis sessions (session_token cookie), argon2 auth,
  Nodemailer, fluent-ffmpeg, and full gamification system ported from bundle
- Frontend: @directus/sdk replaced by graphql-request v7; services.ts fully
  rewritten with identical signatures; directus.ts now re-exports from api.ts
- Cookie renamed directus_session_token → session_token
- Dev proxy target updated 8055 → 4000
- compose.yml: Directus service removed, backend service added (port 4000)
- Dockerfile.backend: new multi-stage image with ffmpeg
- Dockerfile: bundle build step and ffmpeg removed from frontend image
- data-migration.ts: one-time script to migrate all Directus/sexy_ tables

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/backend/src/lib/auth.ts

@@ -0,0 +1,28 @@
+import Redis from "ioredis";
+
+export type SessionUser = {
+  id: string;
+  email: string;
+  role: "model" | "viewer" | "admin";
+  first_name: string | null;
+  last_name: string | null;
+  artist_name: string | null;
+  slug: string | null;
+  avatar: string | null;
+};
+
+export const redis = new Redis(process.env.REDIS_URL || "redis://localhost:6379");
+
+export async function setSession(token: string, user: SessionUser): Promise<void> {
+  await redis.set(`session:${token}`, JSON.stringify(user), "EX", 86400);
+}
+
+export async function getSession(token: string): Promise<SessionUser | null> {
+  const data = await redis.get(`session:${token}`);
+  if (!data) return null;
+  return JSON.parse(data) as SessionUser;
+}
+
+export async function deleteSession(token: string): Promise<void> {
+  await redis.del(`session:${token}`);
+}