feat: user search/discovery

Previously the only way to find someone to follow was knowing their
exact username. Add GET /api/v1/users/search (name/username ilike,
excludes blocked-either-way) and a /people page with debounced search
+ inline follow buttons. Linked from the Explore page.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/users/search/route.ts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, users, userBlocks, eq, and, or, ne, ilike, isNotNull } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+export async function GET(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const q = req.nextUrl.searchParams.get("q")?.trim().slice(0, 50) ?? "";
+  if (q.length < 2) return NextResponse.json({ users: [] });
+
+  const blocked = await db
+    .select({ blockedId: userBlocks.blockedId })
+    .from(userBlocks)
+    .where(eq(userBlocks.blockerId, session!.user.id));
+  const blockedByMe = new Set(blocked.map((b) => b.blockedId));
+
+  const blockedMe = await db
+    .select({ blockerId: userBlocks.blockerId })
+    .from(userBlocks)
+    .where(eq(userBlocks.blockedId, session!.user.id));
+  const haveBlockedMe = new Set(blockedMe.map((b) => b.blockerId));
+
+  const rows = await db
+    .select({
+      id: users.id,
+      name: users.name,
+      username: users.username,
+      avatarUrl: users.avatarUrl,
+      bio: users.bio,
+    })
+    .from(users)
+    .where(
+      and(
+        isNotNull(users.username),
+        ne(users.id, session!.user.id),
+        or(ilike(users.name, `%${q}%`), ilike(users.username, `%${q}%`))
+      )
+    )
+    .limit(20);
+
+  const filtered = rows.filter((u) => !blockedByMe.has(u.id) && !haveBlockedMe.has(u.id));
+
+  return NextResponse.json({ users: filtered });
+}