feat: collections visibility enum (matches recipes) + QR on collection PDF (v0.54.0)

Replaces collections.isPublic (boolean) with collections.visibility
(private/unlisted/public/followers — same enum recipes use). Two-step
migration (0050 adds+backfills, 0051 drops isPublic) since drizzle-kit's
add+drop-in-one-diff rename heuristic needs an interactive prompt we
can't satisfy here.

New collectionVisibleToViewer(viewerId) in lib/visibility.ts mirrors the
existing recipe helper (author always sees own; public/unlisted visible
to anyone; followers-only via the same user_follows EXISTS pattern) —
used by the collection detail page, its print view, fork, and favorite,
replacing their old `or(isPublic, own)` checks.

Create/edit collection dialogs get the same 4-option visibility select
as the recipe form instead of a public/private checkbox.

Collection PDF export now generates a QR code (qrcode, same as the
recipe PDF) linking to /collections/{id}, shown only when visibility is
public/unlisted — same "would an anonymous scanner actually resolve
this" rule as the recipe QR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/collections/explore/page.tsx

@@ -49,7 +49,7 @@ export default async function ExploreCollectionsPage() {
       collectionFavorites,
       and(eq(collectionFavorites.collectionId, collections.id), gte(collectionFavorites.createdAt, sevenDaysAgo))
     )
-    .where(eq(collections.isPublic, true))
+    .where(eq(collections.visibility, "public"))
     .groupBy(collections.id, users.id)
     .orderBy(desc(sql`count(${collectionFavorites.collectionId})`))
     .limit(12);
@@ -63,7 +63,7 @@ export default async function ExploreCollectionsPage() {
     })
     .from(collections)
     .innerJoin(users, eq(collections.userId, users.id))
-    .where(eq(collections.isPublic, true))
+    .where(eq(collections.visibility, "public"))
     .orderBy(desc(collections.createdAt))
     .limit(12);