feat: private accounts, explore/people merge, meal-plan fixes, i18n and theme cleanup

- Private accounts: users.isPrivate hides a user from search and their
  recipes from search/trending/for-you discovery surfaces (follow-aware
  where the route already has session context, blanket exclusion where it
  doesn't); existing followers and direct links are unaffected, no
  follow-request approval flow was built (explicit scope limit)
- Merged /people into the Explore tab (tab=people query param); the old
  standalone route now redirects there
- "Get Ideas" vs "Surprise Me" were doing the same empty-prompt call;
  Surprise Me now injects a real random constraint (5-ingredient, one-pot,
  etc.), matching the existing pattern in the AI recipe-generate dialog
- Meal-plan day cells now link to their recipe (was dead text) and gained
  a one-click "mark as cooked" action
- Theme toggle is now a real three-way light/dark/system control instead
  of a binary flip
- Nutrition goals form had zero i18n wiring; fully localized now

New migration 0027 (users.is_private) generated, left unapplied like the
others. Verified with typecheck, lint, and a clean --no-cache docker build.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/migrations/0027_special_siren.sql

@@ -0,0 +1 @@
+ALTER TABLE "users" ADD COLUMN "is_private" boolean DEFAULT false NOT NULL;

packages/db/src/migrations/meta/_journal.json

@@ -190,6 +190,13 @@
       "when": 1783661460616,
       "tag": "0026_sharp_rictor",
       "breakpoints": true
+    },
+    {
+      "idx": 27,
+      "version": "7",
+      "when": 1783667700330,
+      "tag": "0027_special_siren",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/users.ts

@@ -21,6 +21,7 @@ export const users = pgTable("users", {
   avatarUrl: text("avatar_url"),
   bio: text("bio"),
   privateBio: text("private_bio"),
+  isPrivate: boolean("is_private").notNull().default(false),
   username: text("username").unique(),
   role: userRoleEnum("role").notNull().default("user"),
   tier: tierEnum("tier").notNull().default("free"),