fix(web): proxy Apple charts (CORS) + clear message when Apple search is blocked

Confirmed via curl from a clean IP: Apple's iTunes /search returns 403 (blocked
server-side, likely datacenter-IP anti-scraping) while /lookup?id= still returns 200.
So the Erkunden Apple search fails through no fault of ours.

- Charts: the "most-played" RSS (rss.applemarketingtools.com) was fetched directly
  from the browser and hit CORS; proxy it via /api/itunes-charts/:kind.
- Error visibility: itunesSearch records the last outcome (HTTP status / network);
  the global-search view now shows "Apple-Suche gerade nicht verfügbar" with the
  reason (403 = Apple blocks the API, not you) instead of a blank "no results".
- iTunes proxy now forwards the upstream status code instead of always 200.

Deezer (free, no key, ~50 req/5s) is the planned search fallback; MusicBrainz is too
rate-limited (1/s) for interactive search.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -319,6 +319,20 @@ app.get('/api/itunes/:endpoint', (req, res) => {
   const target = `https://itunes.apple.com/${req.params.endpoint}${qs ? '?' + qs : ''}`;
   https.get(target, { headers: { 'User-Agent': 'NovaSonic/1.0' } }, upstream => {
     res.setHeader('Content-Type', 'application/json');
+    res.status(upstream.statusCode || 200);
+    upstream.pipe(res);
+  }).on('error', e => res.status(502).json({ error: e.message }));
+});
+
+// Apple "most-played" charts RSS — the browser can't fetch rss.applemarketingtools.com directly
+// (no CORS header), so proxy it. kind = albums | songs; country defaults to de.
+app.get('/api/itunes-charts/:kind', (req, res) => {
+  const kind    = req.params.kind === 'songs' ? 'songs' : 'albums';
+  const country = String(req.query.country || 'de').replace(/[^a-z]/gi, '').slice(0, 2).toLowerCase() || 'de';
+  const target  = `https://rss.applemarketingtools.com/api/v2/${country}/music/most-played/50/${kind}.json`;
+  https.get(target, { headers: { 'User-Agent': 'NovaSonic/1.0' } }, upstream => {
+    res.setHeader('Content-Type', 'application/json');
+    res.status(upstream.statusCode || 200);
     upstream.pipe(res);
   }).on('error', e => res.status(502).json({ error: e.message }));
 });