feat: words table, M2M with pictures and categories

- words table with trilingual titles, status enum, difficulty level, timestamps
- word_pictures junction table (M2M words <-> pictures)
- categories placeholder table
- word_categories junction table (M2M words <-> categories)
- Auto-timestamps on status change (requested/published/blocked)
- Full CRUD + link/unlink endpoints for pictures and categories
- README updated with schema and endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -72,7 +72,7 @@ published → blocked
 
 **Planned relations:**
 - `design` → will become a FK to a `designs` table
-- `words` → M2M via junction table once `words` table exists
+- `words` → M2M via `word_pictures` junction table
 
 ---
 
@@ -88,6 +88,53 @@ Deleting a picture via the API also deletes the file from the bucket.
 
 ---
 
+## Database Relations
+
+```
+words ──────────── word_pictures ──────────── pictures
+  │                                               
+  └──────────── word_categories ──────────── categories
+```
+
+### Table: `words`
+
+| Column | Type | Default | Description |
+|---|---|---|---|
+| `id` | `UUID` | `gen_random_uuid()` | Primary key |
+| `titel_de` | `TEXT` | `null` | German title |
+| `titel_en` | `TEXT` | `null` | English title |
+| `titel_se` | `TEXT` | `null` | Swedish title |
+| `status` | `VARCHAR(20)` | `requested` | `requested` · `translated` · `generated` · `blocked` · `published` |
+| `difficulty_level` | `SMALLINT` | `null` | 1–50 |
+| `requested_at` | `TIMESTAMPTZ` | `NOW()` on insert | Auto-set on create |
+| `published_at` | `TIMESTAMPTZ` | `null` | Auto-set when status → `published` |
+| `blocked_at` | `TIMESTAMPTZ` | `null` | Auto-set when status → `blocked` |
+| `created_at` | `TIMESTAMPTZ` | `NOW()` | Auto-set on insert |
+| `updated_at` | `TIMESTAMPTZ` | `NOW()` | Auto-updated on every change (trigger) |
+
+**Status flow:** `requested → translated → generated → published` (blocked possible at any point)
+
+### Table: `word_pictures` (Junction)
+| Column | Type |
+|---|---|
+| `word_id` | `UUID` FK → `words.id` CASCADE |
+| `picture_id` | `UUID` FK → `pictures.id` CASCADE |
+
+### Table: `categories` (Platzhalter — Felder folgen)
+| Column | Type |
+|---|---|
+| `id` | `UUID` PK |
+| `created_at` | `TIMESTAMPTZ` |
+| `updated_at` | `TIMESTAMPTZ` |
+
+### Table: `word_categories` (Junction)
+| Column | Type |
+|---|---|
+| `word_id` | `UUID` FK → `words.id` CASCADE |
+| `category_id` | `UUID` FK → `categories.id` CASCADE |
+
+---
+
 ## API Endpoints
 
 ### Pictures
@@ -201,6 +248,37 @@ curl -X DELETE "$BASE/api/pictures/<ID>" \
 
 ---
 
+### Words
+
+#### `GET /api/words` — Liste (`?status=requested&limit=50&offset=0`)
+#### `GET /api/words/:id` — Einzelnes Word inkl. `picture_ids` und `category_ids`
+#### `POST /api/words` — Neues Word anlegen
+
+```bash
+curl -X POST "$BASE/api/words" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"titel_de": "Hund", "titel_en": "Dog", "titel_se": "Hund", "difficulty_level": 5}'
+```
+
+#### `PATCH /api/words/:id` — Felder aktualisieren (Status setzt Timestamp automatisch)
+
+```bash
+curl -X PATCH "$BASE/api/words/<ID>" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"status": "published"}'
+```
+
+#### `DELETE /api/words/:id` — Word löschen (entfernt auch alle Verknüpfungen)
+
+#### `POST /api/words/:id/pictures/:pictureId` — Bild verknüpfen
+#### `DELETE /api/words/:id/pictures/:pictureId` — Bild-Verknüpfung lösen
+#### `POST /api/words/:id/categories/:categoryId` — Kategorie verknüpfen
+#### `DELETE /api/words/:id/categories/:categoryId` — Kategorie-Verknüpfung lösen
+
+---
+
 ### Utilities
 
 #### `GET /api/tables`