fix: proxy all iTunes/Apple RSS calls through backend to bypass 403 browser block

Apple now blocks direct browser requests from custom origins. Added backend proxy routes:
  GET /api/itunes/search  — iTunes search
  GET /api/itunes/lookup  — iTunes lookup by ID
  GET /api/itunes/charts  — Apple RSS most-played charts (albums/songs)

All itunesSearch/Lookup/TopCharts/TopSongs functions in api.js now route through backend.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -483,6 +483,48 @@ function _spTrackItem(t, defaultAlbum, defaultArt, defaultAlbumArtist) {
   };
 }
 
+// ─── ITUNES PROXY ────────────────────────────────────────────────────────────
+// Browser origin is blocked by Apple (403). All iTunes/Apple RSS calls go through here.
+
+async function itunesProxy(url) {
+  return new Promise((resolve, reject) => {
+    https.get(url, { headers: { 'User-Agent': 'iTunes/12.0' } }, res => {
+      let d = '';
+      res.on('data', c => d += c);
+      res.on('end', () => { try { resolve(JSON.parse(d)); } catch { resolve({}); } });
+    }).on('error', reject);
+  });
+}
+
+app.get('/api/itunes/search', async (req, res) => {
+  try {
+    const { term, entity = 'musicTrack', limit = 25, country = 'us' } = req.query;
+    if (!term) return res.json({ results: [] });
+    const url = `https://itunes.apple.com/search?term=${encodeURIComponent(term)}&media=music&entity=${entity}&limit=${limit}&country=${country}&explicit=Yes`;
+    const d = await itunesProxy(url);
+    res.json({ results: d.results || [] });
+  } catch { res.json({ results: [] }); }
+});
+
+app.get('/api/itunes/lookup', async (req, res) => {
+  try {
+    const { id, entity = 'song', limit = 200, country = 'us' } = req.query;
+    if (!id) return res.json({ results: [] });
+    const url = `https://itunes.apple.com/lookup?id=${id}&entity=${entity}&limit=${limit}&country=${country}&explicit=Yes`;
+    const d = await itunesProxy(url);
+    res.json({ results: d.results || [] });
+  } catch { res.json({ results: [] }); }
+});
+
+app.get('/api/itunes/charts', async (req, res) => {
+  try {
+    const { type = 'albums', country = 'de' } = req.query;
+    const url = `https://rss.applemarketingtools.com/api/v2/${country}/music/most-played/50/${type}.json`;
+    const d = await itunesProxy(url);
+    res.json(d.feed ? { results: d.feed.results || [] } : { results: [] });
+  } catch { res.json({ results: [] }); }
+});
+
 // ─── ROUTES ──────────────────────────────────────────────────────────────────
 
 app.post('/api/spotify/track-artwork', async (req, res) => {