security: widen API-key auth to content/AI routes (v0.27.0)

Convert requireSession -> requireSessionOrApiKey across recipes,
collections, meal-plans, shopping-lists, pantry, feed, and ai/*
(52 routes) so API keys work end-to-end, not just for the handful of
endpoints that supported them before. Scope was explicitly confirmed
per-resource-family with the user before any file was touched.

Left session-cookie-only, deliberately: users/me*, ai-keys/*,
webhooks/*, conversations/*, notifications/*, push/subscribe, admin/*
— account/credential-adjacent surface that shouldn't widen without a
separate, explicit decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/ai/chat-history/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { db, chatMessages, eq, and, isNull, desc, asc, ilike } from "@epicure/db";
-import { requireSession } from "@/lib/api-auth";
+import { requireSessionOrApiKey } from "@/lib/api-auth";
 
 const Schema = z.object({
   recipeId: z.string().uuid().optional(),
@@ -13,7 +13,7 @@ const Schema = z.object({
 });
 
 export async function GET(req: NextRequest) {
-  const { session, response } = await requireSession();
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
   const { searchParams } = new URL(req.url);
@@ -60,7 +60,7 @@ const DeleteSchema = z.object({
 // No `q` here on purpose — clearing is "this whole conversation" (or
 // everything), not "every message matching a search term".
 export async function DELETE(req: NextRequest) {
-  const { session, response } = await requireSession();
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
   const { searchParams } = new URL(req.url);