feat: private accounts, explore/people merge, meal-plan fixes, i18n and theme cleanup

- Private accounts: users.isPrivate hides a user from search and their
  recipes from search/trending/for-you discovery surfaces (follow-aware
  where the route already has session context, blanket exclusion where it
  doesn't); existing followers and direct links are unaffected, no
  follow-request approval flow was built (explicit scope limit)
- Merged /people into the Explore tab (tab=people query param); the old
  standalone route now redirects there
- "Get Ideas" vs "Surprise Me" were doing the same empty-prompt call;
  Surprise Me now injects a real random constraint (5-ingredient, one-pot,
  etc.), matching the existing pattern in the AI recipe-generate dialog
- Meal-plan day cells now link to their recipe (was dead text) and gained
  a one-click "mark as cooked" action
- Theme toggle is now a real three-way light/dark/system control instead
  of a binary flip
- Nutrition goals form had zero i18n wiring; fully localized now

New migration 0027 (users.is_private) generated, left unapplied like the
others. Verified with typecheck, lint, and a clean --no-cache docker build.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/explore/page.tsx

@@ -27,9 +27,9 @@ export type RecipeResult = {
 export default async function ExplorePage({
   searchParams,
 }: {
-  searchParams: Promise<{ q?: string }>;
+  searchParams: Promise<{ q?: string; tab?: string }>;
 }) {
-  const { q } = await searchParams;
+  const { q, tab } = await searchParams;
   const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
 
   // Trending: public recipes ordered by favorite count in last 7 days
@@ -52,7 +52,7 @@ export default async function ExplorePage({
         gte(favorites.createdAt, sevenDaysAgo)
       )
     )
-    .where(eq(recipes.visibility, "public"))
+    .where(and(eq(recipes.visibility, "public"), eq(users.isPrivate, false)))
     .groupBy(recipes.id, users.id)
     .orderBy(desc(sql`count(${favorites.recipeId})`))
     .limit(12);
@@ -69,12 +69,19 @@ export default async function ExplorePage({
     })
     .from(recipes)
     .innerJoin(users, eq(recipes.authorId, users.id))
-    .where(eq(recipes.visibility, "public"))
+    .where(and(eq(recipes.visibility, "public"), eq(users.isPrivate, false)))
     .orderBy(desc(recipes.createdAt))
     .limit(12);
 
   const trending: RecipeResult[] = trendingRows.map(({ favoriteCount: _fc, ...r }) => r);
   const recent: RecipeResult[] = recentRows;
 
-  return <ExplorePageContent trending={trending} recent={recent} initialQuery={q ?? ""} />;
+  return (
+    <ExplorePageContent
+      trending={trending}
+      recent={recent}
+      initialQuery={q ?? ""}
+      initialTab={tab === "people" ? "people" : "recipes"}
+    />
+  );
 }

apps/web/app/(app)/people/page.tsx

@@ -1,22 +1,5 @@
-import type { Metadata } from "next";
-import { headers } from "next/headers";
-import { auth } from "@/lib/auth/server";
-import { PeopleSearch } from "@/components/social/people-search";
-import { getMessages } from "@/lib/i18n/server";
+import { redirect } from "next/navigation";
 
-export const metadata: Metadata = {};
-
-export default async function PeoplePage() {
-  const session = await auth.api.getSession({ headers: await headers() });
-  const m = getMessages((session?.user as { locale?: string } | undefined)?.locale);
-
-  return (
-    <div className="max-w-2xl mx-auto space-y-6">
-      <div>
-        <h1 className="text-2xl font-bold tracking-tight">{m.people.title}</h1>
-        <p className="text-muted-foreground text-sm mt-1">{m.people.subtitle}</p>
-      </div>
-      <PeopleSearch />
-    </div>
-  );
+export default function PeoplePage() {
+  redirect("/explore?tab=people");
 }

apps/web/app/(app)/settings/page.tsx

@@ -12,7 +12,7 @@ export default async function SettingsPage() {
 
   const dbUser = await db.query.users.findFirst({
     where: eq(users.id, session.user.id),
-    columns: { bio: true, privateBio: true },
+    columns: { bio: true, privateBio: true, isPrivate: true },
   });
 
   return (
@@ -24,6 +24,7 @@ export default async function SettingsPage() {
         locale: (session.user as { locale?: string }).locale ?? "en",
         bio: dbUser?.bio ?? null,
         privateBio: dbUser?.privateBio ?? null,
+        isPrivate: dbUser?.isPrivate ?? false,
       }}
     />
   );

apps/web/app/(app)/u/[username]/page.tsx

@@ -2,6 +2,7 @@ import { notFound } from "next/navigation";
 import { headers } from "next/headers";
 import Link from "next/link";
 import Image from "next/image";
+import { Lock } from "lucide-react";
 import { auth } from "@/lib/auth/server";
 import {
   db,
@@ -120,6 +121,12 @@ export default async function UserProfilePage({ params, searchParams }: Params)
     isBlocked = !!blockRow;
   }
 
+  // Private accounts hide their recipe grid from anyone who isn't the owner or an
+  // existing follower. This only affects what's rendered on this direct-link profile
+  // page — it does not change access to a specific recipe's own direct URL, and it
+  // does not gate new follow requests (following stays immediate, no approval step).
+  const isPrivateHidden = user.isPrivate && !isOwnProfile && !isFollowing;
+
   // Cooking history and "cooked it" photo gallery are only meaningful (and visible) to the
   // profile owner: history reveals private behavioral/timing patterns, and photos may be
   // attached to reviews of recipes that aren't visible to other viewers (private recipes),
@@ -210,7 +217,13 @@ export default async function UserProfilePage({ params, searchParams }: Params)
     .join("")
     .toUpperCase();
 
-  const recipesSection =
+  const recipesSection = isPrivateHidden ? (
+    <div className="text-center py-16 text-muted-foreground space-y-2">
+      <Lock className="mx-auto h-8 w-8" />
+      <p className="text-lg font-medium">This account is private</p>
+      <p className="text-sm">Follow @{user.username} to see their recipes.</p>
+    </div>
+  ) : (
     publicRecipes.length > 0 ? (
       <div className="space-y-4">
         <h2 className="text-xl font-semibold">Recipes</h2>
@@ -274,7 +287,8 @@ export default async function UserProfilePage({ params, searchParams }: Params)
       <div className="text-center py-16 text-muted-foreground">
         <p className="text-lg">No public recipes yet.</p>
       </div>
-    );
+    )
+  );
 
   return (
     <div className="max-w-4xl mx-auto space-y-10">
@@ -288,7 +302,14 @@ export default async function UserProfilePage({ params, searchParams }: Params)
         <div className="flex-1 space-y-3">
           <div className="flex flex-wrap items-center gap-3">
             <div>
-              <h1 className="text-2xl font-bold leading-tight">{user.name}</h1>
+              <h1 className="text-2xl font-bold leading-tight flex items-center gap-2">
+                {user.name}
+                {isOwnProfile && user.isPrivate && (
+                  <Badge variant="outline" className="gap-1 text-xs font-normal">
+                    <Lock className="h-3 w-3" /> Private
+                  </Badge>
+                )}
+              </h1>
               <p className="text-muted-foreground text-sm">@{user.username}</p>
             </div>
             {!isOwnProfile && session && (
@@ -304,7 +325,7 @@ export default async function UserProfilePage({ params, searchParams }: Params)
             )}
           </div>
 
-          {user.bio && (
+          {user.bio && !isPrivateHidden && (
             <p className="text-sm leading-relaxed max-w-prose">{user.bio}</p>
           )}