feat: collections visibility enum (matches recipes) + QR on collection PDF (v0.54.0)

Replaces collections.isPublic (boolean) with collections.visibility
(private/unlisted/public/followers — same enum recipes use). Two-step
migration (0050 adds+backfills, 0051 drops isPublic) since drizzle-kit's
add+drop-in-one-diff rename heuristic needs an interactive prompt we
can't satisfy here.

New collectionVisibleToViewer(viewerId) in lib/visibility.ts mirrors the
existing recipe helper (author always sees own; public/unlisted visible
to anyone; followers-only via the same user_follows EXISTS pattern) —
used by the collection detail page, its print view, fork, and favorite,
replacing their old `or(isPublic, own)` checks.

Create/edit collection dialogs get the same 4-option visibility select
as the recipe form instead of a public/private checkbox.

Collection PDF export now generates a QR code (qrcode, same as the
recipe PDF) linking to /collections/{id}, shown only when visibility is
public/unlisted — same "would an anonymous scanner actually resolve
this" rule as the recipe QR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/collections/[id]/fork/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
-import { db, collections, collectionRecipes, eq, and, or } from "@epicure/db";
+import { db, collections, collectionRecipes, eq, and } from "@epicure/db";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
+import { collectionVisibleToViewer } from "@/lib/visibility";
 
 type Params = { params: Promise<{ id: string }> };
 
@@ -9,12 +10,10 @@ export async function POST(req: NextRequest, { params }: Params) {
   if (response) return response;
   const { id } = await params;
 
-  // Allow forking public collections or own collections
+  // Allow forking any collection visible to this viewer (own, or public/
+  // unlisted/followers-if-following) — never a private collection of someone else's.
   const source = await db.query.collections.findFirst({
-    where: and(
-      eq(collections.id, id),
-      or(eq(collections.isPublic, true), eq(collections.userId, session!.user.id))
-    ),
+    where: and(eq(collections.id, id), collectionVisibleToViewer(session!.user.id)),
     with: { recipes: { columns: { recipeId: true } } },
   });
 
@@ -26,7 +25,7 @@ export async function POST(req: NextRequest, { params }: Params) {
     userId: session!.user.id,
     name: `${source.name} (fork)`,
     description: source.description,
-    isPublic: false,
+    visibility: "private",
     createdAt: new Date(),
     updatedAt: new Date(),
   });