feat: private accounts, explore/people merge, meal-plan fixes, i18n and theme cleanup

- Private accounts: users.isPrivate hides a user from search and their
  recipes from search/trending/for-you discovery surfaces (follow-aware
  where the route already has session context, blanket exclusion where it
  doesn't); existing followers and direct links are unaffected, no
  follow-request approval flow was built (explicit scope limit)
- Merged /people into the Explore tab (tab=people query param); the old
  standalone route now redirects there
- "Get Ideas" vs "Surprise Me" were doing the same empty-prompt call;
  Surprise Me now injects a real random constraint (5-ingredient, one-pot,
  etc.), matching the existing pattern in the AI recipe-generate dialog
- Meal-plan day cells now link to their recipe (was dead text) and gained
  a one-click "mark as cooked" action
- Theme toggle is now a real three-way light/dark/system control instead
  of a binary flip
- Nutrition goals form had zero i18n wiring; fully localized now

New migration 0027 (users.is_private) generated, left unapplied like the
others. Verified with typecheck, lint, and a clean --no-cache docker build.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/feed/trending/route.ts

@@ -35,7 +35,7 @@ export async function GET(req: NextRequest) {
         favorites,
         and(eq(favorites.recipeId, recipes.id), gte(favorites.createdAt, sevenDaysAgo))
       )
-      .where(eq(recipes.visibility, "public"))
+      .where(and(eq(recipes.visibility, "public"), eq(users.isPrivate, false)))
       .groupBy(recipes.id, users.id)
       .orderBy(desc(sql`count(${favorites.recipeId})`), desc(recipes.createdAt))
       .limit(limit)
@@ -43,7 +43,8 @@ export async function GET(req: NextRequest) {
     db
       .select({ total: sql<number>`count(*)::int` })
       .from(recipes)
-      .where(eq(recipes.visibility, "public")),
+      .innerJoin(users, eq(recipes.authorId, users.id))
+      .where(and(eq(recipes.visibility, "public"), eq(users.isPrivate, false))),
   ]);
 
   const total = totalRow[0]?.total ?? 0;