Fix: Directus-Auth via Flask-Proxy (CORS umgehen)

Login und Bildliste laufen jetzt über /api/directus/* statt direkt
zu db.hejyou.com – kein CORS-Problem mehr im Browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api.ts

@@ -3,7 +3,7 @@ import type { ObjectMeta, Sentence } from './types'
 const DIRECTUS_URL = 'https://db.hejyou.com'
 
 export async function directusLogin(email: string, password: string): Promise<string> {
-  const res = await fetch(`${DIRECTUS_URL}/auth/login`, {
+  const res = await fetch('/api/directus/auth/login', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ email, password }),
@@ -20,10 +20,9 @@ export interface DirectusPicture {
 }
 
 export async function getDirectusPictures(token: string): Promise<DirectusPicture[]> {
-  const res = await fetch(
-    `${DIRECTUS_URL}/items/pictures?filter[status][_eq]=new&fields=id,media,status&sort=date_created`,
-    { headers: { Authorization: `Bearer ${token}` } }
-  )
+  const res = await fetch('/api/directus/pictures', {
+    headers: { Authorization: `Bearer ${token}` },
+  })
   if (!res.ok) throw new Error('Fehler beim Laden der Directus-Bilder')
   const data = await res.json()
   return data.data as DirectusPicture[]