v1.5: Alle Manager-Komponenten auf eigene API-Routen umgestellt

Neue interne Route Handler unter app/api/ (dishes inkl. Bulk-Delete,
sections, allergens, additives, menu-entries, dish-suggestions,
settings, admin/branding) ersetzen den direkten Browser→Postgrest-
Zugriff der bisherigen Supabase-Anbindung. Jede Route prüft Autorisierung
selbst (lib/auth/session.ts requireRole) statt sich auf Postgres-RLS zu
verlassen – ersetzt 1:1 die bisherigen Policies (öffentlich lesbar /
staff+admin schreiben / nur admin für Einstellungen & Benutzer).

Rezeptvorschlag-Dublettencheck (SuggestionForm) läuft jetzt zwingend
serverseitig im POST-Handler, da es keinen Browser→Postgres-Pfad mehr
gibt. "Passkey annehmen" (SuggestionReview) läuft transaktional
(Gericht anlegen + Vorschlag löschen in einem Schritt).

Logo/Favicon: neuer lokaler Dateispeicher (lib/branding.ts, Docker-
Volume) statt Supabase-Storage-Bucket, ausgeliefert über
app/branding/[filename]. logoUrl()/faviconUrl() liefern jetzt einfache
relative Pfade statt einer fest verdrahteten Supabase-Storage-URL.

DeepL-Route (api/translate) und Benutzerverwaltung (api/admin/users)
laufen jetzt gegen die users-Tabelle statt Supabase Auth.

Alle "use client"-Manager-Komponenten (DishManager, WeekEditor,
SectionManager, CodeListManager, SuggestionForm/Review, UserManager,
DesignEditor) rufen ihre jeweiligen /api/-Routen per fetch() statt den
Supabase-Browser-Client zu nutzen.

app/page.tsx

@@ -1,5 +1,7 @@
 import Link from "next/link";
-import { createClient } from "@/lib/supabase/server";
+import { query } from "@/lib/db";
+import { loadMenuEntries } from "@/lib/db/menu-entries";
+import { getSettings } from "@/lib/db/settings";
 import {
   addDays,
   dishCodes,
@@ -11,7 +13,7 @@ import {
 } from "@/lib/menu";
 import { getDictionary, getLocale } from "@/lib/i18n";
 import { localized, logoUrl, SITE_TITLE } from "@/lib/types";
-import type { CodeItem, MenuEntry, Section } from "@/lib/types";
+import type { CodeItem, Section } from "@/lib/types";
 import PublicMobileMenu from "@/components/PublicMobileMenu";
 import LanguageSwitcher from "@/components/i18n/LanguageSwitcher";
 
@@ -31,29 +33,15 @@ export default async function Home({
     iso: addDays(monday, i),
   }));
 
-  const supabase = await createClient();
-  const [sectionsRes, entriesRes, allergensRes, additivesRes, settingsRes] =
-    await Promise.all([
-      supabase.from("sections").select("*").order("sort"),
-      supabase
-        .from("menu_entries")
-        .select(
-          "id, menu_date, section_key, position, dish:dishes(id, name, name_en, name_pl, price, allergens, additives)"
-        )
-        .gte("menu_date", monday)
-        .lte("menu_date", friday)
-        .order("position")
-        .order("created_at"),
-      supabase.from("allergens").select("*").order("sort"),
-      supabase.from("additives").select("*").order("sort"),
-      supabase.from("settings").select("logo_path").eq("id", 1).maybeSingle(),
-    ]);
+  const [sections, entries, allergens, additives, settings] = await Promise.all([
+    query<Section>("select * from sections order by sort"),
+    loadMenuEntries(monday, friday),
+    query<CodeItem>("select * from allergens order by sort"),
+    query<CodeItem>("select * from additives order by sort"),
+    getSettings(),
+  ]);
 
-  const sections = (sectionsRes.data ?? []) as Section[];
-  const entries = (entriesRes.data ?? []) as unknown as MenuEntry[];
-  const allergens = (allergensRes.data ?? []) as CodeItem[];
-  const additives = (additivesRes.data ?? []) as CodeItem[];
-  const logo = logoUrl(settingsRes.data?.logo_path);
+  const logo = logoUrl(settings?.logo_path);
 
   return (
     <div className="flex-1 px-4 py-6 max-w-[1600px] mx-auto w-full">