feat: push+email notifications, recipe notes, fork/clone, pantry-aware lists, GDPR export

Five S-sized items from HANDOFF.md's new-features backlog, all wiring up
previously-orphaned infra:

- createNotification now sends web push + email for every notification type
  (follow/comment/reply/reaction/rating/mention), not just comments
- Personal recipe notes: private per-user notes on any viewable recipe
  (recipeNotes table had zero API/UI before this)
- Recipe fork/clone: deep-copies a viewable recipe into your own library as
  a private draft, linked via recipeVariations, respects tier quota
- Pantry-aware shopping lists: meal-plan-generated lists now subtract
  on-hand pantry quantities (ingredientId match, falling back to normalized
  name match) and flag partial/ambiguous matches instead of guessing
- GDPR data export: downloadable JSON of a user's own content and activity
  across every relevant table, secrets/internal tables excluded

New migrations 0025 (unique index for recipe-notes upsert) and 0026
(shopping_list_items.in_pantry) generated, left unapplied like 0023/0024.
Verified with typecheck, lint, and a full local `docker build`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/components/meal-plan/shopping-list-view.tsx

@@ -15,6 +15,7 @@ type Item = {
   unit: string | null;
   aisle: string | null;
   checked: boolean;
+  inPantry?: boolean;
 };
 
 export function ShoppingListView({
@@ -119,6 +120,11 @@ export function ShoppingListView({
                 <span className={cn("flex-1 text-sm", item.checked && "line-through text-muted-foreground")}>
                   {item.rawName}
                 </span>
+                {item.inPantry && (
+                  <span className="text-[10px] font-medium uppercase tracking-wide text-emerald-600 dark:text-emerald-400 bg-emerald-500/10 rounded px-1.5 py-0.5 shrink-0">
+                    {tShopping("alreadyInPantry")}
+                  </span>
+                )}
                 {(hasQuantity(item.quantity) || item.unit) && (
                   <span className={cn("text-xs text-muted-foreground tabular-nums shrink-0", item.checked && "opacity-50")}>
                     {hasQuantity(item.quantity) ? item.quantity : ""}{item.unit ? ` ${item.unit}` : ""}

apps/web/components/recipe/fork-recipe-button.tsx

@@ -0,0 +1,47 @@
+"use client";
+
+import { useState } from "react";
+import { useTranslations } from "next-intl";
+import { useRouter } from "next/navigation";
+import { GitFork, Loader2 } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+import { toast } from "sonner";
+
+export function ForkRecipeButton({ recipeId }: { recipeId: string }) {
+  const t = useTranslations("recipe");
+  const router = useRouter();
+  const [forking, setForking] = useState(false);
+
+  async function handleFork() {
+    setForking(true);
+    try {
+      const res = await fetch(`/api/v1/recipes/${recipeId}/fork`, { method: "POST" });
+      if (!res.ok) {
+        const data = await res.json() as { error?: string };
+        throw new Error(
+          res.status === 403 ? t("forkLimitReached") : (data.error ?? t("forkFailed"))
+        );
+      }
+      const data = await res.json() as { id: string };
+      toast.success(t("forked"));
+      router.push(`/recipes/${data.id}`);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : t("forkFailed"));
+      setForking(false);
+    }
+  }
+
+  return (
+    <TooltipProvider>
+      <Tooltip>
+        <TooltipTrigger render={
+          <Button variant="ghost" size="icon" onClick={() => { void handleFork(); }} disabled={forking} aria-label={t("forkTooltip")}>
+            {forking ? <Loader2 className="h-4 w-4 animate-spin" /> : <GitFork className="h-4 w-4" />}
+          </Button>
+        } />
+        <TooltipContent>{t("forkTooltip")}</TooltipContent>
+      </Tooltip>
+    </TooltipProvider>
+  );
+}

apps/web/components/recipe/recipe-notes.tsx

@@ -0,0 +1,68 @@
+"use client";
+
+import { useState } from "react";
+import { useTranslations } from "next-intl";
+import { Lock } from "lucide-react";
+import { toast } from "sonner";
+import { Button } from "@/components/ui/button";
+import { Textarea } from "@/components/ui/textarea";
+
+export function RecipeNotes({
+  recipeId,
+  initialContent,
+}: {
+  recipeId: string;
+  initialContent: string;
+}) {
+  const t = useTranslations("recipeNotes");
+  const [content, setContent] = useState(initialContent);
+  const [savedContent, setSavedContent] = useState(initialContent);
+  const [saving, setSaving] = useState(false);
+
+  const dirty = content !== savedContent;
+
+  async function save() {
+    setSaving(true);
+    try {
+      const res = await fetch(`/api/v1/recipes/${recipeId}/notes`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ content }),
+      });
+      if (!res.ok) {
+        toast.error(t("saveFailed"));
+        return;
+      }
+      const data = (await res.json()) as { note: { content: string } | null };
+      const newContent = data.note?.content ?? "";
+      setContent(newContent);
+      setSavedContent(newContent);
+      toast.success(t("saved"));
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  return (
+    <div className="rounded-lg border border-dashed p-4 space-y-3">
+      <div className="flex items-center gap-2 text-sm font-medium">
+        <Lock className="h-4 w-4 text-muted-foreground" />
+        {t("title")}
+      </div>
+      <p className="text-xs text-muted-foreground">{t("visibilityHint")}</p>
+      <Textarea
+        value={content}
+        onChange={(e) => setContent(e.target.value)}
+        onBlur={() => dirty && !saving && save()}
+        placeholder={t("placeholder")}
+        maxLength={5000}
+        rows={3}
+      />
+      <div className="flex justify-end">
+        <Button type="button" size="sm" variant="outline" disabled={!dirty || saving} onClick={save}>
+          {saving ? t("saving") : t("save")}
+        </Button>
+      </div>
+    </div>
+  );
+}

apps/web/components/settings/security-form.tsx

@@ -2,7 +2,7 @@
 
 import { useState } from "react";
 import { toast } from "sonner";
-import { Button } from "@/components/ui/button";
+import { Button, buttonVariants } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { useTranslations } from "next-intl";
@@ -138,6 +138,20 @@ export function SecurityForm({ currentEmail }: { currentEmail: string }) {
           </Button>
         </form>
       </section>
+
+      <section className="rounded-xl border p-6 space-y-4">
+        <div>
+          <h2 className="font-semibold text-lg">{t("downloadData")}</h2>
+          <p className="text-sm text-muted-foreground mt-1">{t("downloadDataDescription")}</p>
+        </div>
+        <a
+          href="/api/v1/users/me/export"
+          download
+          className={buttonVariants({ variant: "outline" })}
+        >
+          {t("downloadDataButton")}
+        </a>
+      </section>
     </div>
   );
 }