feat: notifications system, rate limiting, fix recipe visibility 404, follow race

Part of the social-feature backlog (follow, comments, reactions, ratings,
feed, threading) audited earlier — see conversation.

- notifications table: follow/comment/reply/reaction/rating events,
  replaces the fully-dead feed_items table (feed_item_type enum existed
  but had zero references anywhere in the codebase).
- Bell UI in the nav with unread badge, mark-all-read, 30s poll.
- Rate limiting on comment posting (20/min), follow/unfollow (30/min),
  and comment reactions (60/min) — previously unthrottled.
- /recipes/[id] queried by (id, authorId=session.user) only, so any
  recipe not owned by the viewer 404'd regardless of visibility.
  Widen the query to include public/unlisted recipes and gate the
  owner-only actions (edit, delete, version history, translate, AI
  content generation) behind an isOwner check.
- user_follows had no primary key/unique constraint, so the follow
  route's onConflictDoNothing() was a silent no-op — concurrent follow
  clicks could insert duplicate rows and inflate follower counts. Add
  a composite primary key on (follower_id, following_id).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/users/[username]/follow/route.ts

@@ -1,12 +1,18 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db, users, userFollows, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+import { createNotification } from "@/lib/notifications";
 
 type Params = { params: Promise<{ username: string }> };
 
 export async function POST(_req: NextRequest, { params }: Params) {
   const { session, response } = await requireSession();
   if (response) return response;
+
+  const limited = await applyRateLimit(`rl:follow:${session!.user.id}`, 30, 60);
+  if (limited) return limited;
+
   const { username } = await params;
 
   const target = await db.query.users.findFirst({ where: eq(users.username, username) });
@@ -17,6 +23,8 @@ export async function POST(_req: NextRequest, { params }: Params) {
     .values({ followerId: session!.user.id, followingId: target.id })
     .onConflictDoNothing();
 
+  void createNotification({ userId: target.id, type: "follow", actorId: session!.user.id });
+
   return NextResponse.json({ following: true });
 }