v1.5: Alle Manager-Komponenten auf eigene API-Routen umgestellt

Neue interne Route Handler unter app/api/ (dishes inkl. Bulk-Delete,
sections, allergens, additives, menu-entries, dish-suggestions,
settings, admin/branding) ersetzen den direkten Browser→Postgrest-
Zugriff der bisherigen Supabase-Anbindung. Jede Route prüft Autorisierung
selbst (lib/auth/session.ts requireRole) statt sich auf Postgres-RLS zu
verlassen – ersetzt 1:1 die bisherigen Policies (öffentlich lesbar /
staff+admin schreiben / nur admin für Einstellungen & Benutzer).

Rezeptvorschlag-Dublettencheck (SuggestionForm) läuft jetzt zwingend
serverseitig im POST-Handler, da es keinen Browser→Postgres-Pfad mehr
gibt. "Passkey annehmen" (SuggestionReview) läuft transaktional
(Gericht anlegen + Vorschlag löschen in einem Schritt).

Logo/Favicon: neuer lokaler Dateispeicher (lib/branding.ts, Docker-
Volume) statt Supabase-Storage-Bucket, ausgeliefert über
app/branding/[filename]. logoUrl()/faviconUrl() liefern jetzt einfache
relative Pfade statt einer fest verdrahteten Supabase-Storage-URL.

DeepL-Route (api/translate) und Benutzerverwaltung (api/admin/users)
laufen jetzt gegen die users-Tabelle statt Supabase Auth.

Alle "use client"-Manager-Komponenten (DishManager, WeekEditor,
SectionManager, CodeListManager, SuggestionForm/Review, UserManager,
DesignEditor) rufen ihre jeweiligen /api/-Routen per fetch() statt den
Supabase-Browser-Client zu nutzen.

components/DesignEditor.tsx

@@ -1,21 +1,14 @@
 "use client";
 
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useState } from "react";
 import { useRouter } from "next/navigation";
-import { createClient } from "@/lib/supabase/client";
 import { formatMessage } from "@/lib/i18n/shared";
 import { DEFAULT_COLORS, faviconUrl, logoUrl } from "@/lib/types";
 import { useDict } from "@/components/i18n/LocaleProvider";
 
 type AssetKind = "logo" | "favicon";
 
-const ASSET_COLUMN: Record<AssetKind, "logo_path" | "favicon_path"> = {
-  logo: "logo_path",
-  favicon: "favicon_path",
-};
-
 export default function DesignEditor() {
-  const supabase = useMemo(() => createClient(), []);
   const router = useRouter();
   const dict = useDict();
   const colorLabels: Record<string, string> = {
@@ -36,19 +29,16 @@ export default function DesignEditor() {
   const [busy, setBusy] = useState(false);
 
   const load = useCallback(async () => {
-    const { data, error } = await supabase
-      .from("settings")
-      .select("colors, logo_path, favicon_path")
-      .eq("id", 1)
-      .maybeSingle();
-    if (error) {
-      setError(formatMessage(dict.designEditor.loadError, { message: error.message }));
+    const res = await fetch("/api/settings");
+    if (!res.ok) {
+      setError(formatMessage(dict.designEditor.loadError, { message: String(res.status) }));
       return;
     }
+    const data = await res.json();
     setColors({ ...DEFAULT_COLORS, ...(data?.colors ?? {}) });
     setLogoPath(data?.logo_path ?? null);
     setFaviconPath(data?.favicon_path ?? null);
-  }, [supabase, dict]);
+  }, [dict]);
 
   useEffect(() => {
     load();
@@ -58,12 +48,13 @@ export default function DesignEditor() {
     setBusy(true);
     setError(null);
     setInfo(null);
-    const { error } = await supabase
-      .from("settings")
-      .update({ colors })
-      .eq("id", 1);
-    if (error)
-      setError(formatMessage(dict.designEditor.saveError, { message: error.message }));
+    const res = await fetch("/api/settings", {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ colors }),
+    });
+    if (!res.ok)
+      setError(formatMessage(dict.designEditor.saveError, { message: String(res.status) }));
     else {
       setInfo(dict.designEditor.colorsSaved);
       router.refresh();
@@ -87,28 +78,21 @@ export default function DesignEditor() {
     setError(null);
     setInfo(null);
 
-    const oldPath = kind === "logo" ? logoPath : faviconPath;
-    const ext = file.name.split(".").pop()?.toLowerCase() ?? "png";
-    const path = `${kind}-${Date.now()}.${ext}`;
-    const { error: uploadError } = await supabase.storage
-      .from("branding")
-      .upload(path, file, { contentType: file.type });
-    if (uploadError) {
-      setError(formatMessage(dict.designEditor.uploadError, { message: uploadError.message }));
+    const formData = new FormData();
+    formData.append("kind", kind);
+    formData.append("file", file);
+    const res = await fetch("/api/admin/branding", { method: "POST", body: formData });
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}));
+      setError(
+        formatMessage(dict.designEditor.uploadError, {
+          message: data.error ?? String(res.status),
+        })
+      );
       setBusy(false);
       return;
     }
-
-    const { error: settingsError } = await supabase
-      .from("settings")
-      .update({ [ASSET_COLUMN[kind]]: path })
-      .eq("id", 1);
-    if (settingsError) {
-      setError(formatMessage(dict.designEditor.saveError, { message: settingsError.message }));
-      setBusy(false);
-      return;
-    }
-    if (oldPath) await supabase.storage.from("branding").remove([oldPath]);
+    const { path } = await res.json();
 
     if (kind === "logo") setLogoPath(path);
     else setFaviconPath(path);
@@ -130,14 +114,14 @@ export default function DesignEditor() {
       return;
     setBusy(true);
     setError(null);
-    const { error } = await supabase
-      .from("settings")
-      .update({ [ASSET_COLUMN[kind]]: null })
-      .eq("id", 1);
-    if (error) {
-      setError(formatMessage(dict.designEditor.saveError, { message: error.message }));
+    const res = await fetch("/api/admin/branding", {
+      method: "DELETE",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ kind }),
+    });
+    if (!res.ok) {
+      setError(formatMessage(dict.designEditor.saveError, { message: String(res.status) }));
     } else {
-      await supabase.storage.from("branding").remove([path]);
       if (kind === "logo") setLogoPath(null);
       else setFaviconPath(null);
       setInfo(kind === "logo" ? dict.designEditor.logoRemoved : dict.designEditor.faviconRemoved);