feat: private accounts, explore/people merge, meal-plan fixes, i18n and theme cleanup

- Private accounts: users.isPrivate hides a user from search and their
  recipes from search/trending/for-you discovery surfaces (follow-aware
  where the route already has session context, blanket exclusion where it
  doesn't); existing followers and direct links are unaffected, no
  follow-request approval flow was built (explicit scope limit)
- Merged /people into the Explore tab (tab=people query param); the old
  standalone route now redirects there
- "Get Ideas" vs "Surprise Me" were doing the same empty-prompt call;
  Surprise Me now injects a real random constraint (5-ingredient, one-pot,
  etc.), matching the existing pattern in the AI recipe-generate dialog
- Meal-plan day cells now link to their recipe (was dead text) and gained
  a one-click "mark as cooked" action
- Theme toggle is now a real three-way light/dark/system control instead
  of a binary flip
- Nutrition goals form had zero i18n wiring; fully localized now

New migration 0027 (users.is_private) generated, left unapplied like the
others. Verified with typecheck, lint, and a clean --no-cache docker build.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/feed/for-you/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { db, recipes, users, favorites, ratings, eq, and, ne, gte, notInArray, inArray, desc } from "@epicure/db";
+import { db, recipes, users, favorites, ratings, userFollows, eq, and, or, ne, gte, notInArray, inArray, desc, isNotNull } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 import { buildPreferenceMap, rankForYou } from "@/lib/for-you-ranking";
 
@@ -50,10 +50,16 @@ export async function GET(req: NextRequest) {
     })
     .from(recipes)
     .innerJoin(users, eq(recipes.authorId, users.id))
+    .leftJoin(
+      userFollows,
+      and(eq(userFollows.followingId, recipes.authorId), eq(userFollows.followerId, userId))
+    )
     .where(and(
       eq(recipes.visibility, "public"),
       ne(recipes.authorId, userId),
-      notInArray(recipes.id, excludeIds)
+      notInArray(recipes.id, excludeIds),
+      // Private authors are excluded from discovery unless the viewer already follows them.
+      or(eq(users.isPrivate, false), isNotNull(userFollows.followerId))
     ))
     .orderBy(desc(recipes.createdAt))
     .limit(200); // score a bounded recent window rather than the whole table

apps/web/app/api/v1/feed/trending/route.ts

@@ -35,7 +35,7 @@ export async function GET(req: NextRequest) {
         favorites,
         and(eq(favorites.recipeId, recipes.id), gte(favorites.createdAt, sevenDaysAgo))
       )
-      .where(eq(recipes.visibility, "public"))
+      .where(and(eq(recipes.visibility, "public"), eq(users.isPrivate, false)))
       .groupBy(recipes.id, users.id)
       .orderBy(desc(sql`count(${favorites.recipeId})`), desc(recipes.createdAt))
       .limit(limit)
@@ -43,7 +43,8 @@ export async function GET(req: NextRequest) {
     db
       .select({ total: sql<number>`count(*)::int` })
       .from(recipes)
-      .where(eq(recipes.visibility, "public")),
+      .innerJoin(users, eq(recipes.authorId, users.id))
+      .where(and(eq(recipes.visibility, "public"), eq(users.isPrivate, false))),
   ]);
 
   const total = totalRow[0]?.total ?? 0;