feat(annotate): Words-Frame – Safe Words mit Level per Bild speichern

- Rechte Sidebar in zwei Frames aufgeteilt: Objects (bisherig) + Words (neu)
- Words-Frame: Wörter + Level (1–100) per Bild anlegen, dedupliziert via words_pictures Junction
- Pending-Words in Primary-Farbe mit inline Level-Edit, gespeicherte Words in neutralem Grau
- Save-Button speichert alle pending Words nach Directus (status=draft, title_de, level, picture-Link)
- Automatisches Laden der Bild-Words bei Bildwechsel
- Backend: GET/POST /api/directus/pictures/<pic_id>/words (words_pictures Junction, _find_or_create_word)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api.ts

@@ -1,4 +1,4 @@
-import type { ObjectMeta, Sentence } from './types'
+import type { ObjectMeta, Sentence, PictureWord } from './types'
 
 const DIRECTUS_URL = 'https://db.hejyou.com'
 
@@ -282,6 +282,30 @@ export async function deleteWord(wId: string, token: string): Promise<void> {
   if (!res.ok) throw new Error('Fehler beim Löschen des Worts')
 }
 
+export async function getPictureWords(pictureId: string, token: string): Promise<PictureWord[]> {
+  const res = await fetch(`/api/directus/pictures/${pictureId}/words`, {
+    headers: { Authorization: `Bearer ${token}` },
+  })
+  const data = await res.json()
+  if (!res.ok) throw new Error('Fehler beim Laden der Bild-Wörter')
+  return data.data as PictureWord[]
+}
+
+export async function savePictureWords(
+  pictureId: string,
+  words: { title_de: string; level: number }[],
+  token: string
+): Promise<{ saved: number }> {
+  const res = await fetch(`/api/directus/pictures/${pictureId}/words`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ words }),
+  })
+  const data = await res.json()
+  if (!res.ok) throw new Error(data.error || 'Fehler beim Speichern der Wörter')
+  return data
+}
+
 export async function purgeOrphans(objId: string, token: string): Promise<{ orphans_removed: number }> {
   const res = await fetch(`/api/object/${encodeURIComponent(objId)}/purge-orphans`, {
     method: 'POST',