feat: followers-only recipe visibility

Adds a fourth visibility tier alongside private/unlisted/public:
"followers" — visible to the author and anyone who follows them,
excluded from public search/explore/profile listings and from the
anonymous /r/[id] share route, included in the Following feed. The
in-app recipe detail gate and the public share route both check
follow status directly against the DB rather than the union type
alone, since neither previously had any per-viewer access logic for
a non-public/non-owner case.

Requires the generated migration (0041) to run against a live DB —
not applied in this sandbox (no Docker here); run `pnpm db:migrate`.

v0.41.0

apps/web/app/api/v1/recipes/bulk/route.ts

@@ -9,7 +9,7 @@ const BulkDeleteSchema = z.object({
 
 const BulkUpdateSchema = z.object({
   ids: z.array(z.string()).min(1).max(100),
-  visibility: z.enum(["private", "unlisted", "public"]).optional(),
+  visibility: z.enum(["private", "unlisted", "public", "followers"]).optional(),
   addTags: z.array(z.string().min(1).max(40)).max(20).optional(),
   removeTags: z.array(z.string().min(1).max(40)).max(20).optional(),
 });