fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/ai-keys/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { db, userAiKeys, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 import { encrypt } from "@/lib/encrypt";
+import { applyRateLimit } from "@/lib/rate-limit";
 
 const VALID_PROVIDERS = ["openai", "anthropic", "openrouter", "ollama"] as const;
 
@@ -27,6 +28,9 @@ export async function POST(req: Request) {
   const { session, response } = await requireSession();
   if (response) return response;
 
+  const limited = await applyRateLimit(`rl:ai-keys:${session!.user.id}`, 5, 3600);
+  if (limited) return limited;
+
   const body = PostSchema.safeParse(await req.json());
   if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });