fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/recipes/__tests__/route.test.ts

@@ -12,7 +12,7 @@ vi.mock("@/lib/api-auth", () => ({
 }));
 
 vi.mock("@/lib/tiers", () => ({
-  checkTierLimit: vi.fn(),
+  checkAndIncrementTierLimit: vi.fn(),
   incrementUsage: vi.fn(),
   TierLimitError: class TierLimitError extends Error {},
 }));
@@ -134,9 +134,9 @@ describe("POST /api/v1/recipes", () => {
   });
 
   it("returns 403 when tier limit reached", async () => {
-    const { checkTierLimit } = await import("@/lib/tiers");
+    const { checkAndIncrementTierLimit } = await import("@/lib/tiers");
     const { TierLimitError } = await import("@/lib/tiers");
-    vi.mocked(checkTierLimit).mockRejectedValue(new TierLimitError("recipe", "free"));
+    vi.mocked(checkAndIncrementTierLimit).mockRejectedValue(new TierLimitError("recipe", "free"));
 
     const res = await POST(makeRequest("POST", validRecipe));
     expect(res.status).toBe(403);