feat: collections visibility enum (matches recipes) + QR on collection PDF (v0.54.0)

Replaces collections.isPublic (boolean) with collections.visibility
(private/unlisted/public/followers — same enum recipes use). Two-step
migration (0050 adds+backfills, 0051 drops isPublic) since drizzle-kit's
add+drop-in-one-diff rename heuristic needs an interactive prompt we
can't satisfy here.

New collectionVisibleToViewer(viewerId) in lib/visibility.ts mirrors the
existing recipe helper (author always sees own; public/unlisted visible
to anyone; followers-only via the same user_follows EXISTS pattern) —
used by the collection detail page, its print view, fork, and favorite,
replacing their old `or(isPublic, own)` checks.

Create/edit collection dialogs get the same 4-option visibility select
as the recipe form instead of a public/private checkbox.

Collection PDF export now generates a QR code (qrcode, same as the
recipe PDF) linking to /collections/{id}, shown only when visibility is
public/unlisted — same "would an anonymous scanner actually resolve
this" rule as the recipe QR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/openapi.ts

@@ -189,7 +189,8 @@ export function generateOpenApiSpec(): object {
   }));
   const CollectionRef = registry.register("Collection", z.object({
     id: z.string(), userId: z.string(), name: z.string(),
-    description: z.string().nullable(), notes: z.string().nullable(), tags: z.array(z.string()), isPublic: z.boolean(),
+    description: z.string().nullable(), notes: z.string().nullable(), tags: z.array(z.string()),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]),
     createdAt: z.string().datetime(), updatedAt: z.string().datetime(),
     recipes: z.array(CollectionRecipeEntryRef),
   }));
@@ -356,7 +357,8 @@ export function generateOpenApiSpec(): object {
   registry.registerPath({ method: "get", path: "/api/v1/feed", summary: "Activity feed (pull-based) — recent recipes from users you follow", security, request: { query: z.object({ limit: z.coerce.number().int().min(1).max(50).default(20), offset: z.coerce.number().int().min(0).default(0) }) }, responses: { 200: { description: "Paginated", content: { "application/json": { schema: z.object({ data: z.array(FeedRecipeRef), total: z.number(), limit: z.number(), offset: z.number(), message: z.string().optional() }) } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "get", path: "/api/v1/collections", summary: "List collections", security, request: { query: LimitOffset }, responses: { 200: { description: "Paginated collections", content: { "application/json": { schema: PaginatedCollections } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
   const CreateCollectionRef = registry.register("CreateCollection", z.object({
-    name: z.string().min(1).max(100), description: z.string().max(500).optional(), isPublic: z.boolean().default(false),
+    name: z.string().min(1).max(100), description: z.string().max(500).optional(),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]).default("private"),
   }));
   registry.registerPath({ method: "post", path: "/api/v1/collections", summary: "Create a collection", security, request: { body: { content: { "application/json": { schema: CreateCollectionRef } }, required: true } }, responses: { 201: { description: "Created", content: { "application/json": { schema: z.object({ id: z.string() }) } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
 
@@ -368,7 +370,7 @@ export function generateOpenApiSpec(): object {
   const UpdateCollectionRef = registry.register("UpdateCollection", z.object({
     name: z.string().min(1).max(100).optional(), description: z.string().max(500).nullable().optional(),
     notes: z.string().max(2000).nullable().optional(), tags: z.array(z.string().min(1).max(50)).max(20).optional(),
-    isPublic: z.boolean().optional(),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]).optional(),
     addRecipeId: z.string().optional(), addRecipeIds: z.array(z.string()).max(200).optional(),
     removeRecipeId: z.string().optional(), removeRecipeIds: z.array(z.string()).max(200).optional(),
   }));