fix(auth): SDK'yı kaldırıp ince REST katmanına geç (lib/appwrite-rest.ts)

Sorun:
- node-appwrite v20-25 hepsi Node 26'da bozuk (node-fetch-native-with-agent polyfill)
- appwrite browser SDK Server Action context'inde 'unexpected response' veriyor
  (büyük olasılıkla browser-only global'ları kontrol ederken)

Çözüm:
- Tüm Appwrite SDK'larını sil (appwrite + node-appwrite)
- lib/appwrite-rest.ts: native fetch üzerinde ~250 satırlık ince REST wrapper
  - account: createEmailPasswordSession, get, deleteSession
  - tablesDB: listRows, getRow, createRow, updateRow, deleteRow
  - storage: listFiles, createFile, deleteFile, fileViewUrl
  - Q helpers: equal, orderAsc/Desc, limit, offset
  - AppwriteError class
- Session secret cookie tabanlı auth korundu (isletmem-kovakcrm'deki desen)
- Tüm CRUD action ve query'ler REST katmanına bağlandı

End-to-end test edildi:
✓ Login (proper 401 hata mesajları, başarılı durumda redirect)
✓ Public read (services, blog, testimonials)
✓ Anonim create (contact form)
✓ Build (24 route)
✓ Sıfır SDK bağımlılığı — Node 26 sorunu yok

app/admin/(protected)/blog/[id]/edit/page.tsx

@@ -1,6 +1,6 @@
 import { notFound } from "next/navigation";
 import { getRow } from "@/lib/data";
-import { TABLES } from "@/lib/appwrite-server";
+import { TABLES } from "@/lib/appwrite-rest";
 import type { BlogPostRow } from "@/lib/types";
 import { BlogForm } from "../../form";
 

app/admin/(protected)/hizmetler/[id]/edit/page.tsx

@@ -1,6 +1,6 @@
 import { notFound } from "next/navigation";
 import { getRow } from "@/lib/data";
-import { TABLES } from "@/lib/appwrite-server";
+import { TABLES } from "@/lib/appwrite-rest";
 import type { ServiceRow } from "@/lib/types";
 import { ServiceForm } from "../../form";
 

app/admin/(protected)/medya/page.tsx

@@ -1,7 +1,6 @@
 import { PageHeader } from "@/components/admin/form";
-import { MEDIA_BUCKET_ID, userStorage } from "@/lib/appwrite-server";
+import { MEDIA_BUCKET_ID, Q, storage } from "@/lib/appwrite-rest";
 import { requireSessionSecret } from "@/lib/auth";
-import { Query } from "appwrite";
 import { Upload } from "lucide-react";
 import { DeleteButton } from "@/components/admin/delete-button";
 import { uploadMedia, deleteMediaFile } from "@/lib/admin-actions";
@@ -9,10 +8,11 @@ import { uploadMedia, deleteMediaFile } from "@/lib/admin-actions";
 async function listFiles() {
   try {
     const secret = await requireSessionSecret();
-    const res = await userStorage(secret).listFiles({
-      bucketId: MEDIA_BUCKET_ID,
-      queries: [Query.orderDesc("$createdAt"), Query.limit(100)],
-    });
+    const res = await storage.listFiles(
+      MEDIA_BUCKET_ID,
+      [Q.orderDesc("$createdAt"), Q.limit(100)],
+      secret,
+    );
     return res.files;
   } catch {
     return [];
@@ -20,7 +20,7 @@ async function listFiles() {
 }
 
 function fileViewUrl(id: string) {
-  return `${process.env.NEXT_PUBLIC_APPWRITE_ENDPOINT}/storage/buckets/${MEDIA_BUCKET_ID}/files/${id}/view?project=${process.env.NEXT_PUBLIC_APPWRITE_PROJECT_ID}`;
+  return storage.fileViewUrl(MEDIA_BUCKET_ID, id);
 }
 
 export default async function MediaPage() {

app/admin/(protected)/page.tsx

@@ -1,17 +1,17 @@
 import Link from "next/link";
 import { ArrowRight } from "lucide-react";
-import { Query } from "appwrite";
-import { DATABASE_ID, TABLES, userDB } from "@/lib/appwrite-server";
+import { DATABASE_ID, Q, TABLES, tablesDB } from "@/lib/appwrite-rest";
 import { requireSessionSecret } from "@/lib/auth";
 
 async function safeCount(tableId: string, queries: string[] = []) {
   try {
     const secret = await requireSessionSecret();
-    const res = await userDB(secret).listRows({
-      databaseId: DATABASE_ID,
+    const res = await tablesDB.listRows(
+      DATABASE_ID,
       tableId,
-      queries: [...queries, Query.limit(1)],
-    });
+      [...queries, Q.limit(1)],
+      secret,
+    );
     return res.total ?? 0;
   } catch {
     return 0;
@@ -21,12 +21,12 @@ async function safeCount(tableId: string, queries: string[] = []) {
 export default async function AdminDashboard() {
   const [posts, drafts, services, projects, testimonials, newMessages, totalMessages] =
     await Promise.all([
-      safeCount(TABLES.blogPosts, [Query.equal("status", "published")]),
-      safeCount(TABLES.blogPosts, [Query.equal("status", "draft")]),
+      safeCount(TABLES.blogPosts, [Q.equal("status", "published")]),
+      safeCount(TABLES.blogPosts, [Q.equal("status", "draft")]),
       safeCount(TABLES.services),
       safeCount(TABLES.projects),
       safeCount(TABLES.testimonials),
-      safeCount(TABLES.contactMessages, [Query.equal("status", "new")]),
+      safeCount(TABLES.contactMessages, [Q.equal("status", "new")]),
       safeCount(TABLES.contactMessages),
     ]);
 

app/admin/(protected)/projeler/[id]/edit/page.tsx

@@ -1,6 +1,6 @@
 import { notFound } from "next/navigation";
 import { getRow } from "@/lib/data";
-import { TABLES } from "@/lib/appwrite-server";
+import { TABLES } from "@/lib/appwrite-rest";
 import type { ProjectRow } from "@/lib/types";
 import { ProjectForm } from "../../form";
 

app/admin/(protected)/referanslar/[id]/edit/page.tsx

@@ -1,6 +1,6 @@
 import { notFound } from "next/navigation";
 import { getRow } from "@/lib/data";
-import { TABLES } from "@/lib/appwrite-server";
+import { TABLES } from "@/lib/appwrite-rest";
 import type { TestimonialRow } from "@/lib/types";
 import { TestimonialForm } from "../../form";
 

app/admin/(protected)/seo/[id]/edit/page.tsx

@@ -1,6 +1,6 @@
 import { notFound } from "next/navigation";
 import { getRow } from "@/lib/data";
-import { TABLES } from "@/lib/appwrite-server";
+import { TABLES } from "@/lib/appwrite-rest";
 import type { SeoPageRow } from "@/lib/types";
 import { SeoPageForm } from "../../page-form";
 

app/admin/login/actions.ts

@@ -2,14 +2,27 @@
 
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
-import { Account, Client } from "appwrite";
+import { account, AppwriteError } from "@/lib/appwrite-rest";
 import { SESSION_COOKIE } from "@/lib/auth";
 
-const endpoint = process.env.NEXT_PUBLIC_APPWRITE_ENDPOINT!;
-const projectId = process.env.NEXT_PUBLIC_APPWRITE_PROJECT_ID!;
-
 export type LoginState = { error?: string };
 
+function friendly(err: unknown): string {
+  if (err instanceof AppwriteError) {
+    switch (err.type) {
+      case "user_invalid_credentials":
+        return "E-posta veya şifre hatalı.";
+      case "user_blocked":
+        return "Hesabınız engellenmiş.";
+      case "general_rate_limit_exceeded":
+        return "Çok fazla deneme. Birkaç dakika sonra tekrar deneyin.";
+      default:
+        return err.message;
+    }
+  }
+  return err instanceof Error ? err.message : "Giriş başarısız";
+}
+
 export async function loginAction(
   _prev: LoginState | undefined,
   formData: FormData,
@@ -19,28 +32,35 @@ export async function loginAction(
 
   if (!email || !password) return { error: "E-posta ve şifre zorunlu" };
 
+  let session;
   try {
-    const client = new Client().setEndpoint(endpoint).setProject(projectId);
-    const account = new Account(client);
-    const session = await account.createEmailPasswordSession({ email, password });
-    const store = await cookies();
-    store.set(SESSION_COOKIE, session.secret, {
-      httpOnly: true,
-      sameSite: "lax",
-      secure: process.env.NODE_ENV === "production",
-      path: "/",
-      expires: new Date(session.expire),
-    });
+    session = await account.createEmailPasswordSession(email, password);
   } catch (err) {
-    const msg = err instanceof Error ? err.message : "Giriş başarısız";
-    return { error: msg };
+    return { error: friendly(err) };
   }
 
+  const store = await cookies();
+  store.set(SESSION_COOKIE, session.secret, {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: process.env.NODE_ENV === "production",
+    path: "/",
+    expires: new Date(session.expire),
+  });
+
   redirect("/admin");
 }
 
 export async function logoutAction() {
   const store = await cookies();
+  const secret = store.get(SESSION_COOKIE)?.value;
+  if (secret) {
+    try {
+      await account.deleteSession("current", secret);
+    } catch {
+      // ignore — cookie is cleared anyway
+    }
+  }
   store.delete(SESSION_COOKIE);
   redirect("/admin/login");
 }