fix: return clean errors and refund quota on AI provider failures

AI routes had no consistent error handling — a provider failure (e.g.
OpenRouter returning a degraded-model error) crashed the route as an
uncaught 500 and, worse, still charged the user's monthly aiCall
quota for a request that never succeeded.

Adds withAiQuota()/aiErrorResponse() (lib/ai/ai-error.ts) and applies
them across all 12 AI generation routes: charges the quota, runs the
AI call, refunds the credit and returns a clean user-facing message
if it throws. Frontend needs no changes — existing dialogs already
toast whatever `error` string comes back.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/ai/variations/[id]/route.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { and, eq } from "@epicure/db";
 import { db, recipes } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
-import { checkAndIncrementTierLimit } from "@/lib/tiers";
+import { withAiQuota } from "@/lib/ai/ai-error";
 import { suggestVariations } from "@/lib/ai/features/suggest-variations";
 import { withUserKey } from "@/lib/ai/resolve-user-key";
 import { getUserPrivateBio } from "@/lib/ai/user-bio";
@@ -38,24 +38,26 @@ export async function POST(req: NextRequest, { params }: Params) {
     return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
   }
 
-  await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "aiCall");
-
   const [aiConfig, privateBio] = await Promise.all([
     withUserKey(session!.user.id, { provider: parsed.data.provider, model: parsed.data.model }),
     getUserPrivateBio(session!.user.id),
   ]);
-  const variations = await suggestVariations(
-    {
-      title: recipe.title,
-      description: recipe.description,
-      ingredients: recipe.ingredients,
-      steps: recipe.steps,
-    },
-    parsed.data.count,
-    { ...aiConfig, userContext: privateBio ?? undefined },
-    parsed.data.directions,
-    (session!.user as { locale?: string }).locale ?? "en"
-  );
 
-  return NextResponse.json({ variations });
+  const result = await withAiQuota(session!.user.id, session!.user.tier as "free" | "pro", () =>
+    suggestVariations(
+      {
+        title: recipe.title,
+        description: recipe.description,
+        ingredients: recipe.ingredients,
+        steps: recipe.steps,
+      },
+      parsed.data.count,
+      { ...aiConfig, userContext: privateBio ?? undefined },
+      parsed.data.directions,
+      (session!.user as { locale?: string }).locale ?? "en"
+    )
+  );
+  if (!result.ok) return result.response;
+
+  return NextResponse.json({ variations: result.data });
 }