feat: followers-only recipe visibility

Adds a fourth visibility tier alongside private/unlisted/public:
"followers" — visible to the author and anyone who follows them,
excluded from public search/explore/profile listings and from the
anonymous /r/[id] share route, included in the Following feed. The
in-app recipe detail gate and the public share route both check
follow status directly against the DB rather than the union type
alone, since neither previously had any per-viewer access logic for
a non-public/non-owner case.

Requires the generated migration (0041) to run against a live DB —
not applied in this sandbox (no Docker here); run `pnpm db:migrate`.

v0.41.0

apps/web/lib/openapi.ts

@@ -58,7 +58,7 @@ export function generateOpenApiSpec(): object {
 
   const RecipeRef = registry.register("Recipe", z.object({
     id: z.string(), authorId: z.string(), title: z.string(), description: z.string().nullable(),
-    baseServings: z.number().int(), recipeType: z.enum(["dish", "drink"]), visibility: z.enum(["private", "unlisted", "public"]),
+    baseServings: z.number().int(), recipeType: z.enum(["dish", "drink"]), visibility: z.enum(["private", "unlisted", "public", "followers"]),
     difficulty: z.enum(["easy", "medium", "hard"]).nullable(),
     prepMins: z.number().int().nullable(), cookMins: z.number().int().nullable(),
     tags: z.array(z.string()), sourceUrl: z.string().nullable(), language: z.string().nullable(),
@@ -72,7 +72,7 @@ export function generateOpenApiSpec(): object {
 
   const RecipeSummaryRef = registry.register("RecipeSummary", z.object({
     id: z.string(), authorId: z.string(), title: z.string(), description: z.string().nullable(),
-    baseServings: z.number().int(), recipeType: z.enum(["dish", "drink"]), visibility: z.enum(["private", "unlisted", "public"]),
+    baseServings: z.number().int(), recipeType: z.enum(["dish", "drink"]), visibility: z.enum(["private", "unlisted", "public", "followers"]),
     difficulty: z.enum(["easy", "medium", "hard"]).nullable(),
     prepMins: z.number().int().nullable(), cookMins: z.number().int().nullable(),
     tags: z.array(z.string()), dietaryTags: DietaryTagsRef, aiGenerated: z.boolean(),
@@ -87,7 +87,7 @@ export function generateOpenApiSpec(): object {
     description: z.string().max(2000).optional(),
     baseServings: z.number().int().min(1).max(100).default(4),
     recipeType: z.enum(["dish", "drink"]).default("dish"),
-    visibility: z.enum(["private", "unlisted", "public"]).default("private"),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]).default("private"),
     difficulty: z.enum(["easy", "medium", "hard"]).optional(),
     prepMins: z.number().int().min(0).max(1440).optional(),
     cookMins: z.number().int().min(0).max(1440).optional(),
@@ -130,7 +130,7 @@ export function generateOpenApiSpec(): object {
     description: z.string().max(2000).nullable().optional(),
     baseServings: z.number().int().min(1).max(100).optional(),
     recipeType: z.enum(["dish", "drink"]).optional(),
-    visibility: z.enum(["private", "unlisted", "public"]).optional(),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]).optional(),
     difficulty: z.enum(["easy", "medium", "hard"]).nullable().optional(),
     prepMins: z.number().int().min(0).max(1440).nullable().optional(),
     cookMins: z.number().int().min(0).max(1440).nullable().optional(),
@@ -247,7 +247,7 @@ export function generateOpenApiSpec(): object {
   const idParam = z.object({ id: z.string() });
   const weekStartParam = z.object({ weekStart: z.string().describe("ISO date YYYY-MM-DD (Monday)") });
 
-  registry.registerPath({ method: "get", path: "/api/v1/recipes", summary: "List your own recipes", description: "Returns a lean summary per recipe — no ingredients/steps/photos/batchDishes (use GET /recipes/{id} for full detail).", security, request: { query: z.object({ limit: z.coerce.number().max(100).default(20), offset: z.coerce.number().default(0), visibility: z.enum(["private", "unlisted", "public"]).optional(), recipeType: z.enum(["dish", "drink"]).optional() }) }, responses: { 200: { description: "Paginated", content: { "application/json": { schema: PaginatedRecipes } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
+  registry.registerPath({ method: "get", path: "/api/v1/recipes", summary: "List your own recipes", description: "Returns a lean summary per recipe — no ingredients/steps/photos/batchDishes (use GET /recipes/{id} for full detail).", security, request: { query: z.object({ limit: z.coerce.number().max(100).default(20), offset: z.coerce.number().default(0), visibility: z.enum(["private", "unlisted", "public", "followers"]).optional(), recipeType: z.enum(["dish", "drink"]).optional() }) }, responses: { 200: { description: "Paginated", content: { "application/json": { schema: PaginatedRecipes } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "post", path: "/api/v1/recipes", summary: "Create recipe", security, request: { body: { content: { "application/json": { schema: CreateRecipeRef } }, required: true } }, responses: { 201: { description: "Created", content: { "application/json": { schema: RecipeRef } } }, 400: { description: "Bad request", content: { "application/json": { schema: ApiErrorRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "get", path: "/api/v1/recipes/{id}", summary: "Get recipe", security, request: { params: idParam }, responses: { 200: { description: "Recipe", content: { "application/json": { schema: RecipeRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "put", path: "/api/v1/recipes/{id}", summary: "Update recipe", security, request: { params: idParam, body: { content: { "application/json": { schema: UpdateRecipeRef } }, required: true } }, responses: { 200: { description: "Updated", content: { "application/json": { schema: RecipeRef } } }, 400: { description: "Bad request", content: { "application/json": { schema: ApiErrorRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
@@ -262,7 +262,7 @@ export function generateOpenApiSpec(): object {
   const BulkIdsRef = registry.register("BulkIds", z.object({ ids: z.array(z.string()).min(1).max(100) }));
   const BulkUpdateRecipesRef = registry.register("BulkUpdateRecipes", z.object({
     ids: z.array(z.string()).min(1).max(100),
-    visibility: z.enum(["private", "unlisted", "public"]).optional(),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]).optional(),
     addTags: z.array(z.string().min(1).max(40)).max(20).optional(),
     removeTags: z.array(z.string().min(1).max(40)).max(20).optional(),
   }));
@@ -319,7 +319,7 @@ export function generateOpenApiSpec(): object {
   const FeedRecipeRef = registry.register("FeedRecipe", z.object({
     id: z.string(), title: z.string(), description: z.string().nullable(),
     baseServings: z.number().int(), prepMins: z.number().int().nullable(), cookMins: z.number().int().nullable(),
-    difficulty: z.enum(["easy", "medium", "hard"]).nullable(), visibility: z.enum(["private", "unlisted", "public"]),
+    difficulty: z.enum(["easy", "medium", "hard"]).nullable(), visibility: z.enum(["private", "unlisted", "public", "followers"]),
     tags: z.array(z.string()), isBatchCook: z.boolean(), sourceUrl: z.string().nullable(), recipeType: z.enum(["dish", "drink"]),
     createdAt: z.string().datetime(), updatedAt: z.string().datetime(), authorId: z.string(),
     authorName: z.string(), authorUsername: z.string().nullable(), authorAvatarUrl: z.string().nullable(),
@@ -597,7 +597,7 @@ export function generateOpenApiSpec(): object {
   const TrendingRecipeRef = registry.register("TrendingRecipe", z.object({
     id: z.string(), title: z.string(), description: z.string().nullable(),
     baseServings: z.number().int(), prepMins: z.number().int().nullable(), cookMins: z.number().int().nullable(),
-    difficulty: z.enum(["easy", "medium", "hard"]).nullable(), visibility: z.enum(["private", "unlisted", "public"]),
+    difficulty: z.enum(["easy", "medium", "hard"]).nullable(), visibility: z.enum(["private", "unlisted", "public", "followers"]),
     aiGenerated: z.boolean(), createdAt: z.string().datetime(), authorId: z.string(),
     authorName: z.string(), authorUsername: z.string().nullable(), authorAvatarUrl: z.string().nullable(),
     favoriteCount: z.number().int(),
@@ -605,7 +605,7 @@ export function generateOpenApiSpec(): object {
   const ForYouRecipeRef = registry.register("ForYouRecipe", z.object({
     id: z.string(), title: z.string(), description: z.string().nullable(),
     baseServings: z.number().int(), prepMins: z.number().int().nullable(), cookMins: z.number().int().nullable(),
-    difficulty: z.enum(["easy", "medium", "hard"]).nullable(), visibility: z.enum(["private", "unlisted", "public"]),
+    difficulty: z.enum(["easy", "medium", "hard"]).nullable(), visibility: z.enum(["private", "unlisted", "public", "followers"]),
     aiGenerated: z.boolean(), createdAt: z.string().datetime(), authorId: z.string(),
     authorName: z.string(), authorUsername: z.string().nullable(), authorAvatarUrl: z.string().nullable(),
     tags: z.array(z.string()), isBatchCook: z.boolean(), sourceUrl: z.string().nullable(), recipeType: z.enum(["dish", "drink"]),
@@ -620,7 +620,7 @@ export function generateOpenApiSpec(): object {
   const SearchResultRef = registry.register("SearchResult", z.object({
     id: z.string(), title: z.string(), description: z.string().nullable(), difficulty: z.enum(["easy", "medium", "hard"]).nullable(),
     baseServings: z.number().int(), prepMins: z.number().int().nullable(), cookMins: z.number().int().nullable(),
-    visibility: z.enum(["private", "unlisted", "public"]), tags: z.array(z.string()), isBatchCook: z.boolean(),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]), tags: z.array(z.string()), isBatchCook: z.boolean(),
     sourceUrl: z.string().nullable(), recipeType: z.enum(["dish", "drink"]),
     authorId: z.string(), authorName: z.string(), createdAt: z.string().datetime(),
     avgRating: z.number().nullable(), ratingCount: z.number().int(),