feat: general cooking-question chatbot on the recipes homepage

The existing recipe chat (RecipeChatPanel) is tightly scoped to one
recipe — recipeId is required and its system prompt embeds that recipe's
full ingredient/step context. Added a sibling, not a modification: a new
floating assistant on the recipes list page for questions that aren't
about any specific recipe (technique, substitutions, timing, food safety).

New /api/v1/ai/cooking-chat route (same quota/rate-limit/model-resolution
pattern as recipe-chat, minus the recipe lookup) and CookingAssistantPanel
component (same floating-button + Sheet UI). Positioned at bottom-24
rather than bottom-6 so it doesn't sit in the same band as the recipe
list's floating bulk-action bar during select mode.

Verified locally: asked a real cooking question through the actual UI,
got a correctly-formatted markdown answer with no recipe context leaking
in (confirmed the request payload only carries the question, no recipeId).

apps/web/app/(app)/recipes/page.tsx

@@ -7,6 +7,7 @@ import { eq, desc, asc, and, ilike, or, inArray } from "@epicure/db";
 import { RecipesHeader } from "@/components/recipe/recipes-header";
 import { RecipesEmptyState } from "@/components/recipe/recipes-empty-state";
 import { RecipesGrid } from "@/components/recipe/recipes-grid";
+import { CookingAssistantPanel } from "@/components/recipe/cooking-assistant-panel";
 import { getMessages } from "@/lib/i18n/server";
 
 export const metadata: Metadata = {};
@@ -139,6 +140,8 @@ export default async function RecipesPage({ searchParams }: { searchParams: Sear
           )}
         </div>
       )}
+
+      <CookingAssistantPanel />
     </div>
   );
 }

apps/web/app/(app)/settings/webhooks/docs/page.tsx

@@ -1,10 +1,17 @@
 import type { Metadata } from "next";
+import Link from "next/link";
+import { ArrowLeft } from "lucide-react";
 
 export const metadata: Metadata = {};
 
 export default function WebhookDocsPage() {
   return (
     <div className="max-w-3xl mx-auto space-y-10 py-8">
+      <Link href="/settings/webhooks" className="inline-flex items-center gap-1.5 text-sm text-muted-foreground hover:text-foreground">
+        <ArrowLeft className="h-3.5 w-3.5" />
+        Back to Webhooks
+      </Link>
+
       <div>
         <h1 className="text-2xl font-bold mb-2">Webhook Documentation</h1>
         <p className="text-muted-foreground">

apps/web/app/api/v1/ai/cooking-chat/route.ts

@@ -0,0 +1,50 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { generateText } from "ai";
+import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
+import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
+import { resolveModel } from "@/lib/ai/factory";
+import { getUserPrivateBio, buildUserBioContext } from "@/lib/ai/user-bio";
+
+const Schema = z.object({
+  question: z.string().min(1).max(500),
+});
+
+const LANG: Record<string, string> = { en: "English", fr: "French" };
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error" }, { status: 400 });
+  }
+
+  const limited = await applyRateLimit(`rl:ai:${session!.user.id}`, 30, 60);
+  if (limited) return limited;
+
+  const [configResult, privateBio] = await Promise.all([
+    resolveAiConfigOrError(() => getModelConfigForUseCase(session!.user.id, "text")),
+    getUserPrivateBio(session!.user.id),
+  ]);
+  if (!configResult.ok) return configResult.response;
+  const model = resolveModel(configResult.data);
+  const bioContext = buildUserBioContext(privateBio);
+  const locale = (session!.user as { locale?: string }).locale ?? "en";
+  const lang = LANG[locale] ?? "English";
+
+  const result = await withAiQuota(session!.user.id, session!.user.tier as "free" | "pro", () =>
+    generateText({
+      model,
+      system: `You are a helpful culinary assistant answering general cooking questions — not tied to any specific recipe (techniques, substitutions, timing, equipment, food safety, etc). If a question has nothing to do with cooking or food, politely redirect. Keep answers under 200 words. Respond in ${lang}.${bioContext}`,
+      prompt: parsed.data.question,
+    })
+  );
+  if (!result.ok) return result.response;
+
+  return NextResponse.json({ answer: result.data.text });
+}

apps/web/components/recipe/cooking-assistant-panel.tsx

@@ -0,0 +1,179 @@
+"use client";
+
+import { useState, useRef, useEffect } from "react";
+import { useTranslations } from "next-intl";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Sheet, SheetContent, SheetHeader, SheetTitle } from "@/components/ui/sheet";
+import { MessageCircle, Send, Bot, User } from "lucide-react";
+import ReactMarkdown from "react-markdown";
+import { cn } from "@/lib/utils";
+
+type Message = {
+  role: "user" | "assistant";
+  content: string;
+};
+
+export function CookingAssistantPanel() {
+  const t = useTranslations("cookingChat");
+  const [open, setOpen] = useState(false);
+  const [messages, setMessages] = useState<Message[]>([]);
+  const [input, setInput] = useState("");
+  const [loading, setLoading] = useState(false);
+  const bottomRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    if (open && bottomRef.current) {
+      bottomRef.current.scrollIntoView({ behavior: "smooth" });
+    }
+  }, [messages, open]);
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    const question = input.trim();
+    if (!question || loading) return;
+
+    setInput("");
+    setMessages((prev) => [...prev, { role: "user", content: question }]);
+    setLoading(true);
+
+    try {
+      const res = await fetch("/api/v1/ai/cooking-chat", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ question }),
+      });
+      const data = await res.json() as { answer?: string; error?: string };
+      setMessages((prev) => [
+        ...prev,
+        { role: "assistant", content: data.answer ?? t("sorry") },
+      ]);
+    } catch {
+      setMessages((prev) => [
+        ...prev,
+        { role: "assistant", content: t("error") },
+      ]);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const suggestions = [
+    t("suggestion1"),
+    t("suggestion2"),
+    t("suggestion3"),
+    t("suggestion4"),
+  ];
+
+  return (
+    <>
+      <Button
+        variant="default"
+        size="icon"
+        // bottom-24 (not bottom-6, like the per-recipe chat button) clears the
+        // recipe list's floating bulk-action bar, which occupies the bottom-4
+        // to bottom-8 band while select mode is active.
+        className="fixed bottom-24 right-6 h-12 w-12 rounded-full shadow-lg z-40"
+        onClick={() => setOpen(true)}
+        aria-label={t("ariaLabel")}
+      >
+        <MessageCircle className="h-5 w-5" />
+      </Button>
+
+      <Sheet open={open} onOpenChange={setOpen}>
+        <SheetContent side="right" className="w-full sm:w-[420px] flex flex-col p-0">
+          <SheetHeader className="px-4 py-3 pr-10 border-b shrink-0">
+            <SheetTitle className="text-base flex items-center gap-2">
+              <Bot className="h-4 w-4 text-primary" />
+              {t("title")}
+            </SheetTitle>
+            <p className="text-xs text-muted-foreground text-left">{t("subtitle")}</p>
+          </SheetHeader>
+
+          <div className="flex-1 overflow-y-auto px-4 py-4 space-y-4 min-h-0">
+            {messages.length === 0 && (
+              <div className="space-y-3">
+                <p className="text-sm text-muted-foreground text-center py-4">
+                  {t("intro")}
+                </p>
+                <div className="space-y-2">
+                  {suggestions.map((s) => (
+                    <button
+                      key={s}
+                      onClick={() => setInput(s)}
+                      className="w-full text-left text-sm px-3 py-2 rounded-lg border bg-muted/50 hover:bg-muted transition-colors"
+                    >
+                      {s}
+                    </button>
+                  ))}
+                </div>
+              </div>
+            )}
+
+            {messages.map((msg, i) => (
+              <div
+                key={i}
+                className={cn(
+                  "flex gap-2 items-start",
+                  msg.role === "user" && "flex-row-reverse"
+                )}
+              >
+                <div className={cn(
+                  "h-7 w-7 shrink-0 rounded-full flex items-center justify-center",
+                  msg.role === "user"
+                    ? "bg-primary text-primary-foreground"
+                    : "bg-muted text-muted-foreground"
+                )}>
+                  {msg.role === "user" ? <User className="h-3.5 w-3.5" /> : <Bot className="h-3.5 w-3.5" />}
+                </div>
+                <div className={cn(
+                  "rounded-xl px-3 py-2 text-sm max-w-[80%] leading-relaxed",
+                  msg.role === "user"
+                    ? "bg-primary text-primary-foreground whitespace-pre-wrap"
+                    : "bg-muted space-y-2 [&_ul]:list-disc [&_ol]:list-decimal [&_ul]:pl-4 [&_ol]:pl-4 [&_strong]:font-semibold [&_li]:my-0.5"
+                )}>
+                  {msg.role === "assistant" ? (
+                    <ReactMarkdown>{msg.content}</ReactMarkdown>
+                  ) : (
+                    msg.content
+                  )}
+                </div>
+              </div>
+            ))}
+
+            {loading && (
+              <div className="flex gap-2 items-start">
+                <div className="h-7 w-7 shrink-0 rounded-full flex items-center justify-center bg-muted text-muted-foreground">
+                  <Bot className="h-3.5 w-3.5" />
+                </div>
+                <div className="rounded-xl px-3 py-2 bg-muted">
+                  <span className="flex gap-1">
+                    <span className="w-1.5 h-1.5 rounded-full bg-muted-foreground animate-bounce [animation-delay:0ms]" />
+                    <span className="w-1.5 h-1.5 rounded-full bg-muted-foreground animate-bounce [animation-delay:150ms]" />
+                    <span className="w-1.5 h-1.5 rounded-full bg-muted-foreground animate-bounce [animation-delay:300ms]" />
+                  </span>
+                </div>
+              </div>
+            )}
+
+            <div ref={bottomRef} />
+          </div>
+
+          <form onSubmit={handleSubmit} className="px-4 py-3 border-t shrink-0 flex gap-2">
+            <Input
+              value={input}
+              onChange={(e) => setInput(e.target.value)}
+              placeholder={t("inputPlaceholder")}
+              disabled={loading}
+              className="flex-1"
+              autoComplete="off"
+            />
+            <Button type="submit" size="icon" disabled={loading || !input.trim()} aria-label={t("send")}>
+              <Send className="h-4 w-4" />
+            </Button>
+          </form>
+        </SheetContent>
+      </Sheet>
+    </>
+  );
+}

apps/web/lib/api-auth.ts

@@ -67,7 +67,8 @@ export async function requireSessionOrApiKey(
         void db
           .update(apiKeys)
           .set({ lastUsedAt: new Date() })
-          .where(eq(apiKeys.id, keyRow.id));
+          .where(eq(apiKeys.id, keyRow.id))
+          .catch((err) => console.error("[api-auth] failed to update apiKeys.lastUsedAt", err));
 
         const [user] = await db
           .select({

apps/web/messages/en.json

@@ -388,6 +388,20 @@
     "inputPlaceholder": "Ask a question…",
     "send": "Send message"
   },
+  "cookingChat": {
+    "sorry": "Sorry, I couldn't answer that.",
+    "error": "Something went wrong. Please try again.",
+    "suggestion1": "How do I know when oil is hot enough?",
+    "suggestion2": "What's a good substitute for buttermilk?",
+    "suggestion3": "How long can I keep leftovers in the fridge?",
+    "suggestion4": "What's the difference between simmering and boiling?",
+    "ariaLabel": "Ask a cooking question",
+    "title": "Cooking assistant",
+    "subtitle": "Ask any cooking question — not tied to a specific recipe",
+    "intro": "Ask anything about cooking — techniques, substitutions, timing, equipment…",
+    "inputPlaceholder": "Ask a question…",
+    "send": "Send message"
+  },
   "servingScaler": {
     "servings": "Servings",
     "reset": "Reset",

apps/web/messages/fr.json

@@ -388,6 +388,20 @@
     "inputPlaceholder": "Posez une question…",
     "send": "Envoyer le message"
   },
+  "cookingChat": {
+    "sorry": "Désolé, je n'ai pas pu répondre à cela.",
+    "error": "Une erreur s'est produite. Veuillez réessayer.",
+    "suggestion1": "Comment savoir si l'huile est assez chaude ?",
+    "suggestion2": "Quel est un bon substitut au lait fermenté ?",
+    "suggestion3": "Combien de temps puis-je garder des restes au frigo ?",
+    "suggestion4": "Quelle est la différence entre mijoter et bouillir ?",
+    "ariaLabel": "Poser une question de cuisine",
+    "title": "Assistant culinaire",
+    "subtitle": "Posez n'importe quelle question de cuisine — pas liée à une recette précise",
+    "intro": "Demandez n'importe quoi sur la cuisine — techniques, substitutions, minutage, équipement…",
+    "inputPlaceholder": "Posez une question…",
+    "send": "Envoyer le message"
+  },
   "servingScaler": {
     "servings": "Portions",
     "reset": "Réinitialiser",

apps/web/proxy.ts

@@ -13,9 +13,16 @@ export async function proxy(request: NextRequest) {
 
   if (isPublic) return NextResponse.next();
 
+  // API-key clients authenticate via `Authorization: Bearer ek_...`, not a
+  // session cookie — they'd otherwise be rejected here before ever reaching
+  // requireSessionOrApiKey (lib/api-auth.ts), which is the only place that
+  // actually verifies the key. Defer to it instead of requiring a cookie.
+  const authHeader = request.headers.get("authorization");
+  const hasApiKeyHeader = isApi && authHeader?.startsWith("Bearer ek_");
+
   const sessionCookie = getSessionCookie(request);
 
-  if (!sessionCookie) {
+  if (!sessionCookie && !hasApiKeyHeader) {
     if (isApi) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }