security: widen API-key auth to content/AI routes (v0.27.0)

Convert requireSession -> requireSessionOrApiKey across recipes,
collections, meal-plans, shopping-lists, pantry, feed, and ai/*
(52 routes) so API keys work end-to-end, not just for the handful of
endpoints that supported them before. Scope was explicitly confirmed
per-resource-family with the user before any file was touched.

Left session-cookie-only, deliberately: users/me*, ai-keys/*,
webhooks/*, conversations/*, notifications/*, push/subscribe, admin/*
— account/credential-adjacent surface that shouldn't widen without a
separate, explicit decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/collections/[id]/favorite/route.ts

@@ -1,11 +1,11 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db, collections, collectionFavorites, eq, and, or } from "@epicure/db";
-import { requireSession } from "@/lib/api-auth";
+import { requireSessionOrApiKey } from "@/lib/api-auth";
 
 type Params = { params: Promise<{ id: string }> };
 
-export async function POST(_req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+export async function POST(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
   const { id } = await params;
 
@@ -21,8 +21,8 @@ export async function POST(_req: NextRequest, { params }: Params) {
   return NextResponse.json({ favorited: true });
 }
 
-export async function DELETE(_req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+export async function DELETE(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
   const { id } = await params;
 

apps/web/app/api/v1/collections/[id]/fork/route.ts

@@ -1,11 +1,11 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db, collections, collectionRecipes, eq, and, or } from "@epicure/db";
-import { requireSession } from "@/lib/api-auth";
+import { requireSessionOrApiKey } from "@/lib/api-auth";
 
 type Params = { params: Promise<{ id: string }> };
 
-export async function POST(_req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+export async function POST(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
   const { id } = await params;
 

apps/web/app/api/v1/collections/[id]/members/route.ts

@@ -1,14 +1,14 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { db, collections, collectionMembers, users, eq, and } from "@epicure/db";
-import { requireSession } from "@/lib/api-auth";
+import { requireSessionOrApiKey } from "@/lib/api-auth";
 
 type Params = { params: Promise<{ id: string }> };
 
 // ─── GET /api/v1/collections/[id]/members ────────────────────────────────────
 // Owner only — returns members joined with basic user info.
-export async function GET(_req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+export async function GET(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
   const { id } = await params;
@@ -52,7 +52,7 @@ const InviteSchema = z
   });
 
 export async function POST(req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
   const { id } = await params;
@@ -103,7 +103,7 @@ export async function POST(req: NextRequest, { params }: Params) {
 // ─── DELETE /api/v1/collections/[id]/members?memberId=… ──────────────────────
 // Owner OR the member themselves can remove.
 export async function DELETE(req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
   const { id } = await params;

apps/web/app/api/v1/collections/[id]/route.ts

@@ -1,12 +1,12 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { db, collections, collectionRecipes, recipes, eq, and, or, ne, inArray } from "@epicure/db";
-import { requireSession } from "@/lib/api-auth";
+import { requireSessionOrApiKey } from "@/lib/api-auth";
 
 type Params = { params: Promise<{ id: string }> };
 
-export async function GET(_req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+export async function GET(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
   const { id } = await params;
 
@@ -20,7 +20,7 @@ export async function GET(_req: NextRequest, { params }: Params) {
 }
 
 export async function PUT(req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
   const { id } = await params;
 
@@ -77,8 +77,8 @@ export async function PUT(req: NextRequest, { params }: Params) {
   return NextResponse.json({ updated: true });
 }
 
-export async function DELETE(_req: NextRequest, { params }: Params) {
-  const { session, response } = await requireSession();
+export async function DELETE(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
   const { id } = await params;