fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/ai/features/recipe-schema.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+
+export const dietaryTagsSchema = z.object({
+  vegan: z.boolean().optional(),
+  vegetarian: z.boolean().optional(),
+  glutenFree: z.boolean().optional(),
+  dairyFree: z.boolean().optional(),
+  nutFree: z.boolean().optional(),
+  halal: z.boolean().optional(),
+  kosher: z.boolean().optional(),
+});
+
+export const stepSchema = z.object({
+  instruction: z.string(),
+  timerSeconds: z.number().int().optional(),
+});
+
+export function ingredientSchema<Q extends z.ZodTypeAny>(quantity: Q) {
+  return z.object({
+    rawName: z.string(),
+    quantity: quantity.optional(),
+    unit: z.string().optional(),
+    note: z.string().optional(),
+  });
+}