fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/ai/features/import-photo.ts

@@ -1,6 +1,7 @@
 import { generateObject } from "ai";
 import { z } from "zod";
 import { resolveModel, type AiConfig } from "../factory";
+import { dietaryTagsSchema, ingredientSchema, stepSchema } from "./recipe-schema";
 
 const ImportedRecipeSchema = z.object({
   title: z.string(),
@@ -9,25 +10,9 @@ const ImportedRecipeSchema = z.object({
   prepMins: z.number().int().min(0).optional(),
   cookMins: z.number().int().min(0).optional(),
   difficulty: z.enum(["easy", "medium", "hard"]).optional(),
-  dietaryTags: z.object({
-    vegan: z.boolean().optional(),
-    vegetarian: z.boolean().optional(),
-    glutenFree: z.boolean().optional(),
-    dairyFree: z.boolean().optional(),
-    nutFree: z.boolean().optional(),
-    halal: z.boolean().optional(),
-    kosher: z.boolean().optional(),
-  }).optional(),
-  ingredients: z.array(z.object({
-    rawName: z.string(),
-    quantity: z.string().optional(),
-    unit: z.string().optional(),
-    note: z.string().optional(),
-  })),
-  steps: z.array(z.object({
-    instruction: z.string(),
-    timerSeconds: z.number().int().optional(),
-  })),
+  dietaryTags: dietaryTagsSchema.optional(),
+  ingredients: z.array(ingredientSchema(z.string())),
+  steps: z.array(stepSchema),
 });
 
 export type ImportedRecipe = z.infer<typeof ImportedRecipeSchema>;