feat: 6 new per-tier feature flags (off by default) + flag-icon locale switcher + hide BYOK when disabled (v0.74.0)

Extends the existing feature-flags system (previously 3 keys, all
default-enabled) with 6 more: recipe_import_url, recipe_import_photo,
nutrition_estimation, markdown_export, weekly_nutrition,
grocery_delivery. Each FEATURE_DEFINITIONS entry now carries its own
defaultEnabled -- the new 6 default to false, the original 3 stay
true -- so no migration/seed was needed for the "off by default"
requirement, just a per-key fallback instead of a blanket true.

Gated server-side (requireFeatureEnabledResponse, a new shared
helper avoiding six copies of the same try/catch) on: import-url,
import-photo, nutrition POST estimate, bulk markdown export, weekly
meal-plan nutrition GET, Instacart export. Gated client-side by
hiding the trigger entirely (not just disabling) on every page that
renders one: recipe detail (meal/drink pairing buttons, nutrition
panel's estimate button, markdown export), recipes list (import-URL
button, including the OS Share Target auto-import path), new-recipe
page (photo import), meal-plan page (markdown export, weekly
nutrition bar), shopping-list/collection/pantry pages (markdown
export), shopping-list page (Instacart button, now gated by both the
existing env-var check AND the tier flag).

Also: BYOK section on Settings -> AI now hidden entirely for
non-BYOK users (previously showed a locked-and-teased notice, same
inconsistency the Model Prefs fix closed yesterday). Language
switcher shows a flag icon (FlagGB/FlagFR, moved from
components/marketing to components/shared so both the logged-in
settings switcher and the logged-out marketing one can use it)
instead of plain "English"/"Français" text-only options.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/recipes/[id]/nutrition/route.ts

@@ -5,6 +5,7 @@ import { requireSessionOrApiKey } from "@/lib/api-auth";
 import { applyRateLimit } from "@/lib/rate-limit";
 import { withAiQuota } from "@/lib/ai/ai-error";
 import { estimateNutrition } from "@/lib/ai/features/estimate-nutrition";
+import { requireFeatureEnabledResponse } from "@/lib/feature-flags";
 
 type Params = { params: Promise<{ id: string }> };
 
@@ -33,6 +34,9 @@ export async function POST(req: NextRequest, { params }: Params) {
   if (response) return response;
   const { id } = await params;
 
+  const featureDenied = await requireFeatureEnabledResponse(session!.user.id, "nutrition_estimation");
+  if (featureDenied) return featureDenied;
+
   const limited = await applyRateLimit(`rl:ai:${session!.user.id}`, 10, 60);
   if (limited) return limited;
 

apps/web/app/api/v1/recipes/bulk/export/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
 import { db, recipes, eq, and, inArray } from "@epicure/db";
 import { recipeToMarkdown } from "@/lib/markdown/recipe";
+import { requireFeatureEnabledResponse } from "@/lib/feature-flags";
 
 const ExportSchema = z.object({
   ids: z.array(z.string()).min(1).max(100),
@@ -12,6 +13,9 @@ export async function POST(req: NextRequest) {
   const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
+  const featureDenied = await requireFeatureEnabledResponse(session!.user.id, "markdown_export");
+  if (featureDenied) return featureDenied;
+
   const body = ExportSchema.safeParse(await req.json());
   if (!body.success) return NextResponse.json({ error: "Invalid request" }, { status: 400 });