Switch card data source from pokemontcg.io to TCGdex

The Pokémon TCG API is deprecated (no new keys, existing keys end 2027-03-01)
and was returning 5xx errors. TCGdex is free and needs no API key.

- src/lib/api.ts: fetch the card list, then each card and set, with retries
  and limited concurrency; map to the existing TcgCard shape. Pokémon TCG
  Pocket cards are skipped.
- Keep the old card IDs for the 10 cards whose TCGdex ID differs, so saved
  checklists stay valid (verified by name, set and number).
- Fall back to the old image host for cards TCGdex has no scan for, and to a
  placeholder if an image fails to load.
- route.ts: serve the last cached data (marked stale) when a refresh fails;
  drop the API key handling.
- Remove the API key variables from compose and the env example; update README.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -4,8 +4,8 @@ A Next.js web app to browse every English Magikarp Pokémon card with images, se
 
 ## Features
 - **Checklist (variants-aware)**: Track base, holofoil, and reverse holofoil per card. Local persistence with migration from v1 to v2.
-- **Card images**: Uses official images from `images.pokemontcg.io`.
-- **Set symbols**: Displays set symbol and series/name.
+- **Card images**: Card scans from `assets.tcgdex.net` (a placeholder is shown for cards TCGdex has no scan for).
+- **Set badges**: Displays series and set name.
 - **Search & filter**: Search by name/number/rarity/set and filter by set.
 - **Totals include variants**: The header and tab badges use variant totals (base + available variants) for collected/uncollected counts.
 - **Sort by release date**: Cards are ordered by set release date (oldest first).
@@ -32,15 +32,14 @@ npm install
 ```
 
 ### 3) Environment variables
-Get a free Pokémon TCG API key: https://dev.pokemontcg.io/
+No API key is needed. Card data comes from the free [TCGdex](https://tcgdex.dev/) API.
 
-Create one of the following files in the project root and add your key:
-- `.env.local` (recommended for Next.js)
-- `.env` (also supported)
+To enable the optional single-user Basic Auth, create `.env.local` (or `.env`) in the project root:
 
 ```bash
 # .env.local
-NEXT_PUBLIC_POKEMON_TCG_API_KEY=your_key_here
+BASIC_AUTH_USER=your_user
+BASIC_AUTH_PASS=your_password
 ```
 
 An example is provided in `.env.local.example`.
@@ -97,13 +96,15 @@ magikarp-collection/
 ```
 
 ## Data Source
-- Pokémon TCG API v2: https://api.pokemontcg.io/
-  - Endpoint used: `GET /v2/cards` with query `q=name:magikarp`
-  - API key header: `X-Api-Key: <your key>` (automatically added when `NEXT_PUBLIC_POKEMON_TCG_API_KEY` is present)
+- TCGdex REST API v2: https://api.tcgdex.net/v2/en (no key required)
+  - `GET /cards?name=magikarp` lists matching cards; each card (`/cards/{id}`) and each set (`/sets/{id}`) is then fetched for details.
+  - Pokémon TCG Pocket cards are skipped.
+  - Cards whose TCGdex ID differs from the old pokemontcg.io ID keep the old ID (see `LEGACY_CARDS` in `src/lib/api.ts`) so saved checklists stay valid.
+  - The previous source, the Pokémon TCG API (pokemontcg.io), is deprecated.
 
 ## How It Works
 - The client loads data from `GET /api/magikarp` (`src/app/api/magikarp/route.ts`).
-- The route proxies to Pokémon TCG API using `fetchMagikarpCards()` (`src/lib/api.ts`), caches the full response in `data/cards.json`, and serves cached data when fresh (<24h) unless `?refresh=1` is provided.
+- The route fetches from TCGdex using `fetchMagikarpCards()` (`src/lib/api.ts`), caches the full response in `data/cards.json`, and serves cached data when fresh (<24h) unless `?refresh=1` is provided. If a refresh fails, the last cached data is served and marked `stale`.
 - Cards render in `CardGrid`/`CardItem`, ordered by set release date.
 - Checklist persists locally (v2 supports variant-level tracking). A server-backed route exists at `api/checklist` if you enable it.
 
@@ -127,7 +128,7 @@ Open: http://localhost:3000 (or your chosen `APP_PORT`).
 - `data/cards.json` and `data/checklist.json` are gitignored by default.
 
 ## Deployment
-- **Vercel**: Zero-config for Next.js. Add `NEXT_PUBLIC_POKEMON_TCG_API_KEY` in project Environment Variables.
+- **Vercel**: Zero-config for Next.js. No API key is required.
 - **Netlify/Other**: Build command `npm run build`, publish `.next` with a Next adapter or use Next on Node; make sure environment vars are set.
 
 ## Troubleshooting
@@ -137,8 +138,8 @@ Open: http://localhost:3000 (or your chosen `APP_PORT`).
   # Ensure postcss.config.cjs exists with:
   # module.exports = { plugins: { '@tailwindcss/postcss': {} } }
   ```
-- Images not loading: confirm `next.config.ts` allows `images.pokemontcg.io` and restart the dev server.
-- No cards shown: ensure your API key is valid and in `.env.local` (or `.env`). Restart the dev server after changes.
+- Images not loading: confirm `next.config.ts` allows `assets.tcgdex.net` and restart the dev server.
+- No cards shown: check the server log for `Error fetching cards`; if TCGdex is unreachable the app serves the last cached data.
 
 ## License
 This project is provided as-is for personal collection tracking.