feat: make the API Worker reachable only from the web Worker via a service binding

[ABfry]

Summary

• Replaces the public api.tankalizer.jp round-trip with a Cloudflare service binding, so the frontend calls the API Worker directly inside the Workers runtime.
• Combined with removing the API's public routes, the backend is no longer reachable from the internet — closing the door on direct API calls with a spoofed user_id.

Changes

Service binding plumbing

• frontend/wrangler.jsonc: add services binding API → tankalizer-api
• frontend/src/lib/backendFetch.ts (new): resolves the binding via getCloudflareContext() and dispatches requests through env.API.fetch() (the URL host is a dummy label; routing is done by the binding). Falls back to a plain fetch(BACKEND_URL + path) when no binding is available, so local next dev / docker-compose keep working

Call-site migration

• All 12 Server Action files and the NextAuth jwt callback (src/auth/config.ts) now call backendFetch('/v2/...') instead of building URLs from process.env.BACKEND_URL; request methods, bodies, and headers are unchanged

Locking down the API Worker

• backend/wrangler.jsonc: workers_dev: false and preview_urls: false (the api.tankalizer.jp custom domain was removed via the dashboard)

Notes

• Traffic flow after this PR: browser → tankalizer.jp (web Worker) → service binding → API Worker → D1/S3. No DNS, TLS, or public hop between the two Workers
• Verified locally with two wrangler dev processes (binding [connected], SSR post page renders data through the binding) and in production: api.tankalizer.jp now returns 530 while the site serves normally
• BACKEND_URL remains only as the fallback for non-Workers dev environments
• Deploy order matters for future reference: backend first, then frontend; JWT verification on the API is still a worthwhile follow-up even though the external path is gone