fix: close TOCTOU race + missing checks in tier limits, add AI rate limits, patch CVEs (v0.60.0)

Security audit fixes (see SECURITY_AUDIT.md):
- lib/tiers.ts: checkAndIncrementTierLimit's recipe/storage branches did a
  live count/sum check with no lock tying it to the later write, so two
  concurrent requests near the cap could both pass and both write past the
  limit. Added checkTierLimitInTransaction — holds a per-user Postgres
  advisory lock for the duration of the caller's transaction, so the check
  and the write are atomic together. Applied to every recipe/storage write
  path (recipes create/update, fork, rate, avatar, and 7 AI recipe-creation
  routes).
- Adversarial re-verification of that fix caught a bigger gap in the same
  area: four AI routes (photo import, idea generation, batch-cook,
  translate-to-new-draft) had no recipe-limit check at all. Fixed.
- Added missing per-user rate limits to 5 AI endpoints (adapt, drinks,
  pairings, translate, variations) that had none, unlike their siblings.
- search page now checks for a session server-side, matching every other
  page under (app)/ — defense in depth; the underlying API was already
  public by design and proxy.ts already blocked unauthenticated requests.
- admin/settings route now uses the shared requireAdmin instead of a local
  duplicate.
- Documented two admin support-ticket endpoints missing from the OpenAPI
  spec; verified full route/OpenAPI parity otherwise.
- Bumped drizzle-orm to fix a SQL-identifier-escaping CVE, and overrode two
  transitive deps (esbuild, postcss) with known CVEs. pnpm audit is clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/ai/generate-from-idea/route.ts

@@ -8,6 +8,7 @@ import { getUserPrivateBio } from "@/lib/ai/user-bio";
 import { withUserKey } from "@/lib/ai/resolve-user-key";
 import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db";
 import { parseQuantity } from "@/lib/parse-quantity";
+import { checkTierLimitInTransaction, TierLimitError } from "@/lib/tiers";
 
 const Schema = z.object({
   title: z.string().min(1).max(200),
@@ -51,47 +52,58 @@ export async function POST(req: NextRequest) {
 
   const recipeId = crypto.randomUUID();
 
-  await db.insert(recipes).values({
-    id: recipeId,
-    authorId: session!.user.id,
-    title: recipe.title,
-    description: recipe.description ?? null,
-    baseServings: recipe.baseServings,
-    recipeType: recipe.recipeType,
-    prepMins: recipe.prepMins ?? null,
-    cookMins: recipe.cookMins ?? null,
-    difficulty: recipe.difficulty ?? null,
-    visibility: "private",
-    aiGenerated: true,
-    language: locale,
-    dietaryTags: recipe.dietaryTags ?? {},
-    tags: [],
-  });
+  try {
+    await db.transaction(async (tx) => {
+      await checkTierLimitInTransaction(tx, session!.user.id, session!.user.tier as "free" | "pro" | "family", "recipe");
 
-  if (recipe.ingredients?.length) {
-    await db.insert(recipeIngredients).values(
-      recipe.ingredients.map((ing, i) => ({
-        id: crypto.randomUUID(),
-        recipeId,
-        rawName: ing.rawName,
-        quantity: parseQuantity(ing.quantity) ?? null,
-        unit: ing.unit ?? null,
-        note: ing.note ?? null,
-        order: i,
-      }))
-    );
-  }
+      await tx.insert(recipes).values({
+        id: recipeId,
+        authorId: session!.user.id,
+        title: recipe.title,
+        description: recipe.description ?? null,
+        baseServings: recipe.baseServings,
+        recipeType: recipe.recipeType,
+        prepMins: recipe.prepMins ?? null,
+        cookMins: recipe.cookMins ?? null,
+        difficulty: recipe.difficulty ?? null,
+        visibility: "private",
+        aiGenerated: true,
+        language: locale,
+        dietaryTags: recipe.dietaryTags ?? {},
+        tags: [],
+      });
 
-  if (recipe.steps?.length) {
-    await db.insert(recipeSteps).values(
-      recipe.steps.map((step, i) => ({
-        id: crypto.randomUUID(),
-        recipeId,
-        instruction: step.instruction,
-        timerSeconds: step.timerSeconds ?? null,
-        order: i,
-      }))
-    );
+      if (recipe.ingredients?.length) {
+        await tx.insert(recipeIngredients).values(
+          recipe.ingredients.map((ing, i) => ({
+            id: crypto.randomUUID(),
+            recipeId,
+            rawName: ing.rawName,
+            quantity: parseQuantity(ing.quantity) ?? null,
+            unit: ing.unit ?? null,
+            note: ing.note ?? null,
+            order: i,
+          }))
+        );
+      }
+
+      if (recipe.steps?.length) {
+        await tx.insert(recipeSteps).values(
+          recipe.steps.map((step, i) => ({
+            id: crypto.randomUUID(),
+            recipeId,
+            instruction: step.instruction,
+            timerSeconds: step.timerSeconds ?? null,
+            order: i,
+          }))
+        );
+      }
+    });
+  } catch (err) {
+    if (err instanceof TierLimitError) {
+      return NextResponse.json({ error: "Recipe limit reached for your tier" }, { status: 403 });
+    }
+    throw err;
   }
 
   return NextResponse.json({ id: recipeId });