feat: anonymous read-only public link + QR code for meal plans (v0.68.0)

Mirrors shopping lists' isPublic pattern but read-only only -- no
publicEditable equivalent, since anonymous editing of someone's
weekly meal schedule isn't a real use case the way collaborative
shopping-list editing is. New PATCH /api/v1/meal-plans/{weekStart}
toggles it (lazily creates the week's plan row if missing, same
pattern as the existing POST). Public page at /m/[id] renders the
week grouped by day, linking through to public/unlisted recipes and
just showing the title otherwise.

ShareMealPlanButton gained the same public-link toggle UI as its
shopping-list sibling, plus a QR code (generated client-side via the
already-installed `qrcode` package) for the link once enabled --
handing someone a printed or screenshotted plan doesn't require
typing a URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/migrations/0059_pink_doctor_faustus.sql

@@ -0,0 +1 @@
+ALTER TABLE "meal_plans" ADD COLUMN "is_public" boolean DEFAULT false NOT NULL;

packages/db/src/migrations/meta/_journal.json

@@ -414,6 +414,13 @@
       "when": 1784583059359,
       "tag": "0058_quiet_triton",
       "breakpoints": true
+    },
+    {
+      "idx": 59,
+      "version": "7",
+      "when": 1784670176130,
+      "tag": "0059_pink_doctor_faustus",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/meal-planning.ts

@@ -23,6 +23,10 @@ export const mealPlans = pgTable("meal_plans", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   weekStart: date("week_start").notNull(),
+  // Anyone with the link can view (read-only, unlike shopping lists' public
+  // link which can also be made editable) — the unguessable id is the sole
+  // credential, no separate anonymous-visitor identity.
+  isPublic: boolean("is_public").notNull().default(false),
   createdAt: timestamp("created_at").notNull().defaultNow(),
 }, (t) => [
   index("meal_plans_user_idx").on(t.userId),