feat: collections overhaul — reorder, search, edit/delete, tags (v0.53.0)

Seven related improvements to collections:

- Drag-and-drop reorder (dnd-kit, same pattern as the shopping list) — new
  collection_recipes.position column (migration 0049, backfilled from
  existing added_at order so nothing jumps around on upgrade).
- Search collections by name/description (server-side, list page) and
  search recipes within a collection (client-side filter, already loaded).
- Edit collection: name/description/tags/private notes via a new dialog;
  new collections.notes + collections.tags columns.
- Delete collection with a choice to also delete its recipes — only ones
  the deleting user actually owns, never recipes shared in by others.
- Collection detail (both owner and public view) now renders the same
  RecipeGridCard used on /recipes, instead of the older, plainer RecipeCard.
- Collection list cards redesigned — photo-collage preview (first 4 recipe
  covers/placeholders), tag badges, cleaner layout.
- Fixed the recipe count shown on a collection card: the query capped the
  `recipes` relation at 1 for thumbnail purposes and then read `.length`
  off that same capped array, so it never showed more than 1. Now a
  proper grouped count query, separate from the thumbnail fetch.

New/changed endpoints documented in OpenAPI: PATCH /collections/{id}/reorder,
DELETE /collections/{id}?deleteRecipes, PUT /collections/{id}'s new
notes/tags fields.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/openapi.ts

@@ -189,7 +189,7 @@ export function generateOpenApiSpec(): object {
   }));
   const CollectionRef = registry.register("Collection", z.object({
     id: z.string(), userId: z.string(), name: z.string(),
-    description: z.string().nullable(), isPublic: z.boolean(),
+    description: z.string().nullable(), notes: z.string().nullable(), tags: z.array(z.string()), isPublic: z.boolean(),
     createdAt: z.string().datetime(), updatedAt: z.string().datetime(),
     recipes: z.array(CollectionRecipeEntryRef),
   }));
@@ -366,17 +366,23 @@ export function generateOpenApiSpec(): object {
     user: z.object({ name: z.string(), username: z.string().nullable(), avatarUrl: z.string().nullable() }),
   }));
   const UpdateCollectionRef = registry.register("UpdateCollection", z.object({
-    name: z.string().min(1).max(100).optional(), description: z.string().max(500).optional(), isPublic: z.boolean().optional(),
+    name: z.string().min(1).max(100).optional(), description: z.string().max(500).nullable().optional(),
+    notes: z.string().max(2000).nullable().optional(), tags: z.array(z.string().min(1).max(50)).max(20).optional(),
+    isPublic: z.boolean().optional(),
     addRecipeId: z.string().optional(), addRecipeIds: z.array(z.string()).max(200).optional(),
     removeRecipeId: z.string().optional(), removeRecipeIds: z.array(z.string()).max(200).optional(),
   }));
+  const ReorderCollectionRecipesRef = registry.register("ReorderCollectionRecipes", z.object({
+    recipeIds: z.array(z.string()).min(1).max(500).describe("Full ordered list of recipe ids currently in the collection."),
+  }));
   const InviteMemberRef = registry.register("InviteMember", z.object({
     email: z.string().email().optional(), userId: z.string().optional(), role: z.enum(["viewer", "editor"]),
   }));
 
   registry.registerPath({ method: "get", path: "/api/v1/collections/{id}", summary: "Get a collection (owner only)", security, request: { params: idParam }, responses: { 200: { description: "Collection with recipes", content: { "application/json": { schema: CollectionRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "put", path: "/api/v1/collections/{id}", summary: "Update a collection / add-remove recipes (owner only)", security, request: { params: idParam, body: { content: { "application/json": { schema: UpdateCollectionRef } }, required: true } }, responses: { 200: { description: "Updated", content: { "application/json": { schema: z.object({ updated: z.boolean() }) } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
-  registry.registerPath({ method: "delete", path: "/api/v1/collections/{id}", summary: "Delete a collection (owner only)", security, request: { params: idParam }, responses: { 204: { description: "Deleted" }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
+  registry.registerPath({ method: "delete", path: "/api/v1/collections/{id}", summary: "Delete a collection (owner only)", description: "Pass ?deleteRecipes=true to also delete the recipes in it — only ones you own; recipes shared into this collection by others are never touched.", security, request: { params: idParam, query: z.object({ deleteRecipes: z.enum(["true", "false"]).optional() }) }, responses: { 204: { description: "Deleted" }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
+  registry.registerPath({ method: "patch", path: "/api/v1/collections/{id}/reorder", summary: "Reorder the recipes in a collection (owner only)", description: "Pass the full list of recipe ids in the desired order — ids not currently in the collection are ignored.", security, request: { params: idParam, body: { content: { "application/json": { schema: ReorderCollectionRecipesRef } }, required: true } }, responses: { 200: { description: "Reordered", content: { "application/json": { schema: z.object({ ok: z.boolean() }) } } }, 400: { description: "Validation error or no matching recipes", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "post", path: "/api/v1/collections/{id}/fork", summary: "Fork a public (or your own) collection", security, request: { params: idParam }, responses: { 201: { description: "New collection id", content: { "application/json": { schema: z.object({ id: z.string() }) } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "post", path: "/api/v1/collections/{id}/favorite", summary: "Favorite a collection", security, request: { params: idParam }, responses: { 200: { description: "Favorited", content: { "application/json": { schema: z.object({ favorited: z.boolean() }) } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "delete", path: "/api/v1/collections/{id}/favorite", summary: "Unfavorite a collection", security, request: { params: idParam }, responses: { 200: { description: "Unfavorited", content: { "application/json": { schema: z.object({ favorited: z.boolean() }) } } } } });