Fix: Use Next.js API proxy to avoid mixed-content/CORS errors

HTTPS pages cannot fetch from HTTP backend ports. Added Next.js
API route proxies for /api/vocabulary, /api/learning-units, /api/progress
that forward to backend-lehrer internally (same Docker network, HTTP).

All frontend pages now use same-origin requests (getApiBase = '')
instead of direct port:8001 connections.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

studio-v2/app/learn/page.tsx

@@ -17,11 +17,8 @@ interface LearningUnit {
   created_at: string
 }
 
-function getBackendUrl() {
-  if (typeof window === 'undefined') return 'http://localhost:8001'
-  const { hostname, protocol } = window.location
-  if (hostname === 'localhost') return 'http://localhost:8001'
-  return `${protocol}//${hostname}:8001`
+function getApiBase() {
+  return ''  // Same-origin proxy via /api/learning-units/...
 }
 
 export default function LearnPage() {
@@ -41,7 +38,7 @@ export default function LearnPage() {
   const loadUnits = async () => {
     setIsLoading(true)
     try {
-      const resp = await fetch(`${getBackendUrl()}/api/learning-units/`)
+      const resp = await fetch(`${getApiBase()}/api/learning-units/`)
       if (!resp.ok) throw new Error(`HTTP ${resp.status}`)
       const data = await resp.json()
       setUnits(data)
@@ -54,7 +51,7 @@ export default function LearnPage() {
 
   const handleDelete = async (unitId: string) => {
     try {
-      const resp = await fetch(`${getBackendUrl()}/api/learning-units/${unitId}`, { method: 'DELETE' })
+      const resp = await fetch(`${getApiBase()}/api/learning-units/${unitId}`, { method: 'DELETE' })
       if (resp.ok) {
         setUnits((prev) => prev.filter((u) => u.id !== unitId))
       }