fix: drafts page uses server-side API routes (no NEXT_PUBLIC needed)

app/admin/api/drafts/[id]/route.js

@@ -0,0 +1,16 @@
+import { NextResponse } from 'next/server';
+import { requireAdminAuth } from '@/lib/adminAuth';
+import { engineFetch } from '@/lib/engine';
+
+export async function PATCH(req, { params }) {
+  await requireAdminAuth();
+  try {
+    const body = await req.json();
+    const data = await engineFetch(`/api/drafts/${params.id}`, {
+      method: 'PATCH', body: JSON.stringify(body),
+    });
+    return NextResponse.json(data);
+  } catch (err) {
+    return NextResponse.json({ error: err.message }, { status: 500 });
+  }
+}