v1.5: Alle Manager-Komponenten auf eigene API-Routen umgestellt

Neue interne Route Handler unter app/api/ (dishes inkl. Bulk-Delete,
sections, allergens, additives, menu-entries, dish-suggestions,
settings, admin/branding) ersetzen den direkten Browser→Postgrest-
Zugriff der bisherigen Supabase-Anbindung. Jede Route prüft Autorisierung
selbst (lib/auth/session.ts requireRole) statt sich auf Postgres-RLS zu
verlassen – ersetzt 1:1 die bisherigen Policies (öffentlich lesbar /
staff+admin schreiben / nur admin für Einstellungen & Benutzer).

Rezeptvorschlag-Dublettencheck (SuggestionForm) läuft jetzt zwingend
serverseitig im POST-Handler, da es keinen Browser→Postgres-Pfad mehr
gibt. "Passkey annehmen" (SuggestionReview) läuft transaktional
(Gericht anlegen + Vorschlag löschen in einem Schritt).

Logo/Favicon: neuer lokaler Dateispeicher (lib/branding.ts, Docker-
Volume) statt Supabase-Storage-Bucket, ausgeliefert über
app/branding/[filename]. logoUrl()/faviconUrl() liefern jetzt einfache
relative Pfade statt einer fest verdrahteten Supabase-Storage-URL.

DeepL-Route (api/translate) und Benutzerverwaltung (api/admin/users)
laufen jetzt gegen die users-Tabelle statt Supabase Auth.

Alle "use client"-Manager-Komponenten (DishManager, WeekEditor,
SectionManager, CodeListManager, SuggestionForm/Review, UserManager,
DesignEditor) rufen ihre jeweiligen /api/-Routen per fetch() statt den
Supabase-Browser-Client zu nutzen.

components/WeekEditor.tsx

@@ -1,8 +1,7 @@
 "use client";
 
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useState } from "react";
 import Link from "next/link";
-import { createClient } from "@/lib/supabase/client";
 import {
   addDays,
   dishCodes,
@@ -18,7 +17,6 @@ import type { Dish, MenuEntry, Section } from "@/lib/types";
 import { useDict, useLocale } from "@/components/i18n/LocaleProvider";
 
 export default function WeekEditor({ monday }: { monday: string }) {
-  const supabase = useMemo(() => createClient(), []);
   const dict = useDict();
   const locale = useLocale();
   const friday = addDays(monday, 4);
@@ -41,28 +39,19 @@ export default function WeekEditor({ monday }: { monday: string }) {
   const load = useCallback(async () => {
     setError(null);
     const [se, di, en] = await Promise.all([
-      supabase.from("sections").select("*").order("sort"),
-      supabase.from("dishes").select("*").order("name"),
-      supabase
-        .from("menu_entries")
-        .select(
-          "id, menu_date, section_key, position, dish:dishes(id, name, name_en, name_pl, price, allergens, additives)"
-        )
-        .gte("menu_date", monday)
-        .lte("menu_date", friday)
-        .order("position")
-        .order("created_at"),
+      fetch("/api/sections"),
+      fetch("/api/dishes"),
+      fetch(`/api/menu-entries?from=${monday}&to=${friday}`),
     ]);
-    const problem = se.error ?? di.error ?? en.error;
-    if (problem) {
-      setError(formatMessage(dict.weekEditor.loadError, { message: problem.message }));
+    if (!se.ok || !di.ok || !en.ok) {
+      setError(formatMessage(dict.weekEditor.loadError, { message: "load failed" }));
     } else {
-      setSections(se.data as Section[]);
-      setDishes(di.data as Dish[]);
-      setEntries(en.data as unknown as MenuEntry[]);
+      setSections(await se.json());
+      setDishes(await di.json());
+      setEntries(await en.json());
     }
     setLoading(false);
-  }, [supabase, monday, friday, dict]);
+  }, [monday, friday, dict]);
 
   useEffect(() => {
     setLoading(true);
@@ -71,16 +60,21 @@ export default function WeekEditor({ monday }: { monday: string }) {
 
   async function addEntry() {
     if (!adding || !selectedDish) return;
-    const { error } = await supabase.from("menu_entries").insert({
-      menu_date: adding.iso,
-      section_key: adding.section,
-      dish_id: selectedDish,
+    const res = await fetch("/api/menu-entries", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        menu_date: adding.iso,
+        section_key: adding.section,
+        dish_id: selectedDish,
+      }),
     });
-    if (error) {
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}));
       setError(
-        /duplicate key/i.test(error.message)
+        data.error === "duplicate_entry"
           ? dict.weekEditor.duplicateEntry
-          : formatMessage(dict.weekEditor.saveError, { message: error.message })
+          : formatMessage(dict.weekEditor.saveError, { message: data.error ?? String(res.status) })
       );
     }
     setAdding(null);
@@ -89,9 +83,9 @@ export default function WeekEditor({ monday }: { monday: string }) {
   }
 
   async function removeEntry(id: string) {
-    const { error } = await supabase.from("menu_entries").delete().eq("id", id);
-    if (error)
-      setError(formatMessage(dict.weekEditor.deleteError, { message: error.message }));
+    const res = await fetch(`/api/menu-entries/${id}`, { method: "DELETE" });
+    if (!res.ok)
+      setError(formatMessage(dict.weekEditor.deleteError, { message: String(res.status) }));
     await load();
   }