feat(social): follows, favorites, comments, reactions, collections, public profiles

Follow/unfollow users. Recipe favorites. Threaded comments with emoji reactions.
Collections (public/private) with shared member invite. Activity feed.
Public profile pages at /u/[username].

apps/web/app/api/v1/users/[username]/follow/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, users, userFollows, eq, and } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+type Params = { params: Promise<{ username: string }> };
+
+export async function POST(_req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { username } = await params;
+
+  const target = await db.query.users.findFirst({ where: eq(users.username, username) });
+  if (!target) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  if (target.id === session!.user.id) return NextResponse.json({ error: "Cannot follow yourself" }, { status: 400 });
+
+  await db.insert(userFollows)
+    .values({ followerId: session!.user.id, followingId: target.id })
+    .onConflictDoNothing();
+
+  return NextResponse.json({ following: true });
+}
+
+export async function DELETE(_req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { username } = await params;
+
+  const target = await db.query.users.findFirst({ where: eq(users.username, username) });
+  if (!target) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  await db.delete(userFollows).where(
+    and(eq(userFollows.followerId, session!.user.id), eq(userFollows.followingId, target.id))
+  );
+
+  return NextResponse.json({ following: false });
+}

apps/web/app/api/v1/users/[username]/route.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from "next/server";
+import { headers } from "next/headers";
+import { auth } from "@/lib/auth/server";
+import { db, users, recipes, userFollows, eq, and, count } from "@epicure/db";
+
+type Params = { params: Promise<{ username: string }> };
+
+export async function GET(req: NextRequest, { params }: Params) {
+  const { username } = await params;
+
+  const user = await db.query.users.findFirst({ where: eq(users.username, username) });
+  if (!user) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const [followerCountRow, followingCountRow, recipeCountRow] = await Promise.all([
+    db
+      .select({ count: count() })
+      .from(userFollows)
+      .where(eq(userFollows.followingId, user.id)),
+    db
+      .select({ count: count() })
+      .from(userFollows)
+      .where(eq(userFollows.followerId, user.id)),
+    db
+      .select({ count: count() })
+      .from(recipes)
+      .where(and(eq(recipes.authorId, user.id), eq(recipes.visibility, "public"))),
+  ]);
+
+  let isFollowing = false;
+  try {
+    const session = await auth.api.getSession({ headers: await headers() });
+    if (session && session.user.id !== user.id) {
+      const followRow = await db.query.userFollows.findFirst({
+        where: and(
+          eq(userFollows.followerId, session.user.id),
+          eq(userFollows.followingId, user.id),
+        ),
+      });
+      isFollowing = !!followRow;
+    }
+  } catch {
+    // unauthenticated — isFollowing stays false
+  }
+
+  return NextResponse.json({
+    id: user.id,
+    name: user.name,
+    username: user.username,
+    avatarUrl: user.avatarUrl,
+    bio: user.bio,
+    createdAt: user.createdAt,
+    followerCount: followerCountRow[0]?.count ?? 0,
+    followingCount: followingCountRow[0]?.count ?? 0,
+    recipeCount: recipeCountRow[0]?.count ?? 0,
+    isFollowing,
+  });
+}