feat(social): follows, favorites, comments, reactions, collections, public profiles

Follow/unfollow users. Recipe favorites. Threaded comments with emoji reactions.
Collections (public/private) with shared member invite. Activity feed.
Public profile pages at /u/[username].

apps/web/app/api/v1/collections/route.ts

@@ -0,0 +1,43 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, collections, eq, desc } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+const Schema = z.object({
+  name: z.string().min(1).max(100),
+  description: z.string().max(500).optional(),
+  isPublic: z.boolean().default(false),
+});
+
+export async function GET(_req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const rows = await db.query.collections.findMany({
+    where: eq(collections.userId, session!.user.id),
+    orderBy: desc(collections.updatedAt),
+    with: { recipes: { limit: 4, with: { recipe: { with: { photos: true } } } } },
+  });
+
+  return NextResponse.json(rows);
+}
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
+
+  const id = crypto.randomUUID();
+  await db.insert(collections).values({
+    id,
+    userId: session!.user.id,
+    name: parsed.data.name,
+    description: parsed.data.description,
+    isPublic: parsed.data.isPublic,
+  });
+
+  return NextResponse.json({ id }, { status: 201 });
+}