fix: proxy iTunes API through backend to resolve CORS errors

Frontend was calling itunes.apple.com directly; browsers block it (no CORS headers).
Added /api/itunes/:endpoint proxy on the backend and updated all itunesSearch/Lookup
calls in api.js to route through it when backendUrl is configured.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -87,6 +87,19 @@ app.post('/api/spotify/track-artwork', async (req, res) => {
   res.json({ results });
 });
 
+// ─── ITUNES PROXY ─────────────────────────────────────────────────────────────
+// Browsers can't call itunes.apple.com directly (no CORS headers). Proxy it here.
+app.get('/api/itunes/:endpoint', (req, res) => {
+  const allowed = new Set(['search', 'lookup']);
+  if (!allowed.has(req.params.endpoint)) return res.status(404).json({ error: 'not found' });
+  const qs = new URLSearchParams(req.query).toString();
+  const target = `https://itunes.apple.com/${req.params.endpoint}${qs ? '?' + qs : ''}`;
+  https.get(target, { headers: { 'User-Agent': 'NovaSonic/1.0' } }, upstream => {
+    res.setHeader('Content-Type', 'application/json');
+    upstream.pipe(res);
+  }).on('error', e => res.status(502).json({ error: e.message }));
+});
+
 app.get('/api/health', (req, res) => {
   res.json({
     status: 'ok', ytdlpVersion,