feat: private accounts, explore/people merge, meal-plan fixes, i18n and theme cleanup

- Private accounts: users.isPrivate hides a user from search and their
  recipes from search/trending/for-you discovery surfaces (follow-aware
  where the route already has session context, blanket exclusion where it
  doesn't); existing followers and direct links are unaffected, no
  follow-request approval flow was built (explicit scope limit)
- Merged /people into the Explore tab (tab=people query param); the old
  standalone route now redirects there
- "Get Ideas" vs "Surprise Me" were doing the same empty-prompt call;
  Surprise Me now injects a real random constraint (5-ingredient, one-pot,
  etc.), matching the existing pattern in the AI recipe-generate dialog
- Meal-plan day cells now link to their recipe (was dead text) and gained
  a one-click "mark as cooked" action
- Theme toggle is now a real three-way light/dark/system control instead
  of a binary flip
- Nutrition goals form had zero i18n wiring; fully localized now

New migration 0027 (users.is_private) generated, left unapplied like the
others. Verified with typecheck, lint, and a clean --no-cache docker build.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/u/[username]/page.tsx

@@ -2,6 +2,7 @@ import { notFound } from "next/navigation";
 import { headers } from "next/headers";
 import Link from "next/link";
 import Image from "next/image";
+import { Lock } from "lucide-react";
 import { auth } from "@/lib/auth/server";
 import {
   db,
@@ -120,6 +121,12 @@ export default async function UserProfilePage({ params, searchParams }: Params)
     isBlocked = !!blockRow;
   }
 
+  // Private accounts hide their recipe grid from anyone who isn't the owner or an
+  // existing follower. This only affects what's rendered on this direct-link profile
+  // page — it does not change access to a specific recipe's own direct URL, and it
+  // does not gate new follow requests (following stays immediate, no approval step).
+  const isPrivateHidden = user.isPrivate && !isOwnProfile && !isFollowing;
+
   // Cooking history and "cooked it" photo gallery are only meaningful (and visible) to the
   // profile owner: history reveals private behavioral/timing patterns, and photos may be
   // attached to reviews of recipes that aren't visible to other viewers (private recipes),
@@ -210,7 +217,13 @@ export default async function UserProfilePage({ params, searchParams }: Params)
     .join("")
     .toUpperCase();
 
-  const recipesSection =
+  const recipesSection = isPrivateHidden ? (
+    <div className="text-center py-16 text-muted-foreground space-y-2">
+      <Lock className="mx-auto h-8 w-8" />
+      <p className="text-lg font-medium">This account is private</p>
+      <p className="text-sm">Follow @{user.username} to see their recipes.</p>
+    </div>
+  ) : (
     publicRecipes.length > 0 ? (
       <div className="space-y-4">
         <h2 className="text-xl font-semibold">Recipes</h2>
@@ -274,7 +287,8 @@ export default async function UserProfilePage({ params, searchParams }: Params)
       <div className="text-center py-16 text-muted-foreground">
         <p className="text-lg">No public recipes yet.</p>
       </div>
-    );
+    )
+  );
 
   return (
     <div className="max-w-4xl mx-auto space-y-10">
@@ -288,7 +302,14 @@ export default async function UserProfilePage({ params, searchParams }: Params)
         <div className="flex-1 space-y-3">
           <div className="flex flex-wrap items-center gap-3">
             <div>
-              <h1 className="text-2xl font-bold leading-tight">{user.name}</h1>
+              <h1 className="text-2xl font-bold leading-tight flex items-center gap-2">
+                {user.name}
+                {isOwnProfile && user.isPrivate && (
+                  <Badge variant="outline" className="gap-1 text-xs font-normal">
+                    <Lock className="h-3 w-3" /> Private
+                  </Badge>
+                )}
+              </h1>
               <p className="text-muted-foreground text-sm">@{user.username}</p>
             </div>
             {!isOwnProfile && session && (
@@ -304,7 +325,7 @@ export default async function UserProfilePage({ params, searchParams }: Params)
             )}
           </div>
 
-          {user.bio && (
+          {user.bio && !isPrivateHidden && (
             <p className="text-sm leading-relaxed max-w-prose">{user.bio}</p>
           )}