feat: notifications system, rate limiting, fix recipe visibility 404, follow race

Part of the social-feature backlog (follow, comments, reactions, ratings,
feed, threading) audited earlier — see conversation.

- notifications table: follow/comment/reply/reaction/rating events,
  replaces the fully-dead feed_items table (feed_item_type enum existed
  but had zero references anywhere in the codebase).
- Bell UI in the nav with unread badge, mark-all-read, 30s poll.
- Rate limiting on comment posting (20/min), follow/unfollow (30/min),
  and comment reactions (60/min) — previously unthrottled.
- /recipes/[id] queried by (id, authorId=session.user) only, so any
  recipe not owned by the viewer 404'd regardless of visibility.
  Widen the query to include public/unlisted recipes and gate the
  owner-only actions (edit, delete, version history, translate, AI
  content generation) behind an isOwner check.
- user_follows had no primary key/unique constraint, so the follow
  route's onConflictDoNothing() was a silent no-op — concurrent follow
  clicks could insert duplicate rows and inflate follower counts. Add
  a composite primary key on (follower_id, following_id).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/migrations/0016_broken_nemesis.sql

@@ -0,0 +1 @@
+ALTER TABLE "user_follows" ADD CONSTRAINT "user_follows_follower_id_following_id_pk" PRIMARY KEY("follower_id","following_id");

packages/db/src/migrations/0017_shallow_malcolm_colcord.sql

@@ -0,0 +1,2 @@
+DROP TABLE "feed_items" CASCADE;--> statement-breakpoint
+DROP TYPE "public"."feed_item_type";

packages/db/src/migrations/0018_mighty_butterfly.sql

@@ -0,0 +1,18 @@
+CREATE TYPE "public"."notification_type" AS ENUM('follow', 'comment', 'reply', 'reaction', 'rating', 'mention');--> statement-breakpoint
+CREATE TABLE "notifications" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"type" "notification_type" NOT NULL,
+	"actor_id" text NOT NULL,
+	"recipe_id" text,
+	"comment_id" text,
+	"read" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "notifications" ADD CONSTRAINT "notifications_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "notifications" ADD CONSTRAINT "notifications_actor_id_users_id_fk" FOREIGN KEY ("actor_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "notifications" ADD CONSTRAINT "notifications_recipe_id_recipes_id_fk" FOREIGN KEY ("recipe_id") REFERENCES "public"."recipes"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "notifications" ADD CONSTRAINT "notifications_comment_id_comments_id_fk" FOREIGN KEY ("comment_id") REFERENCES "public"."comments"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "notifications_user_idx" ON "notifications" USING btree ("user_id","created_at");--> statement-breakpoint
+CREATE INDEX "notifications_user_unread_idx" ON "notifications" USING btree ("user_id","read");

packages/db/src/migrations/meta/_journal.json

@@ -113,6 +113,27 @@
       "when": 1783105214683,
       "tag": "0015_aromatic_lester",
       "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "7",
+      "when": 1783107462796,
+      "tag": "0016_broken_nemesis",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1783108057675,
+      "tag": "0017_shallow_malcolm_colcord",
+      "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "7",
+      "when": 1783108229117,
+      "tag": "0018_mighty_butterfly",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/social.ts

@@ -11,10 +11,13 @@ import { relations } from "drizzle-orm";
 import { users } from "./users";
 import { recipes } from "./recipes";
 
-export const feedItemTypeEnum = pgEnum("feed_item_type", [
-  "new_recipe",
-  "new_follow",
-  "recipe_rated",
+export const notificationTypeEnum = pgEnum("notification_type", [
+  "follow",
+  "comment",
+  "reply",
+  "reaction",
+  "rating",
+  "mention",
 ]);
 
 export const ratings = pgTable("ratings", {
@@ -78,17 +81,25 @@ export const cookingHistory = pgTable("cooking_history", {
   index("cooking_history_user_idx").on(t.userId),
 ]);
 
-export const feedItems = pgTable("feed_items", {
+export const notifications = pgTable("notifications", {
   id: text("id").primaryKey(),
-  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
-  type: feedItemTypeEnum("type").notNull(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }), // recipient
+  type: notificationTypeEnum("type").notNull(),
   actorId: text("actor_id").notNull().references(() => users.id, { onDelete: "cascade" }),
-  subjectId: text("subject_id").notNull(),
+  recipeId: text("recipe_id").references(() => recipes.id, { onDelete: "cascade" }),
+  commentId: text("comment_id").references(() => comments.id, { onDelete: "cascade" }),
+  read: boolean("read").notNull().default(false),
   createdAt: timestamp("created_at").notNull().defaultNow(),
 }, (t) => [
-  index("feed_items_user_idx").on(t.userId, t.createdAt),
+  index("notifications_user_idx").on(t.userId, t.createdAt),
+  index("notifications_user_unread_idx").on(t.userId, t.read),
 ]);
 
+export const notificationsRelations = relations(notifications, ({ one }) => ({
+  actor: one(users, { fields: [notifications.actorId], references: [users.id] }),
+  recipe: one(recipes, { fields: [notifications.recipeId], references: [recipes.id] }),
+}));
+
 export const ratingsRelations = relations(ratings, ({ one }) => ({
   recipe: one(recipes, { fields: [ratings.recipeId], references: [recipes.id] }),
   user: one(users, { fields: [ratings.userId], references: [users.id] }),

packages/db/src/schema/users.ts

@@ -5,6 +5,7 @@ import {
   boolean,
   integer,
   pgEnum,
+  primaryKey,
 } from "drizzle-orm/pg-core";
 import { relations } from "drizzle-orm";
 
@@ -71,7 +72,9 @@ export const userFollows = pgTable("user_follows", {
   followerId: text("follower_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   followingId: text("following_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   createdAt: timestamp("created_at").notNull().defaultNow(),
-});
+}, (t) => [
+  primaryKey({ columns: [t.followerId, t.followingId] }),
+]);
 
 export const apiKeys = pgTable("api_keys", {
   id: text("id").primaryKey(),