feat: notifications system, rate limiting, fix recipe visibility 404, follow race

Part of the social-feature backlog (follow, comments, reactions, ratings,
feed, threading) audited earlier — see conversation.

- notifications table: follow/comment/reply/reaction/rating events,
  replaces the fully-dead feed_items table (feed_item_type enum existed
  but had zero references anywhere in the codebase).
- Bell UI in the nav with unread badge, mark-all-read, 30s poll.
- Rate limiting on comment posting (20/min), follow/unfollow (30/min),
  and comment reactions (60/min) — previously unthrottled.
- /recipes/[id] queried by (id, authorId=session.user) only, so any
  recipe not owned by the viewer 404'd regardless of visibility.
  Widen the query to include public/unlisted recipes and gate the
  owner-only actions (edit, delete, version history, translate, AI
  content generation) behind an isOwner check.
- user_follows had no primary key/unique constraint, so the follow
  route's onConflictDoNothing() was a silent no-op — concurrent follow
  clicks could insert duplicate rows and inflate follower counts. Add
  a composite primary key on (follower_id, following_id).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/notifications/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from "next/server";
+import { db, notifications, users, eq, and, desc, count } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+export async function GET() {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const [rows, unread] = await Promise.all([
+    db
+      .select({
+        id: notifications.id,
+        type: notifications.type,
+        recipeId: notifications.recipeId,
+        commentId: notifications.commentId,
+        read: notifications.read,
+        createdAt: notifications.createdAt,
+        actorId: notifications.actorId,
+        actorName: users.name,
+        actorUsername: users.username,
+        actorAvatarUrl: users.avatarUrl,
+      })
+      .from(notifications)
+      .innerJoin(users, eq(notifications.actorId, users.id))
+      .where(eq(notifications.userId, session!.user.id))
+      .orderBy(desc(notifications.createdAt))
+      .limit(30),
+    db
+      .select({ total: count() })
+      .from(notifications)
+      .where(and(eq(notifications.userId, session!.user.id), eq(notifications.read, false))),
+  ]);
+
+  return NextResponse.json({ notifications: rows, unreadCount: unread[0]?.total ?? 0 });
+}