feat: collections visibility enum (matches recipes) + QR on collection PDF (v0.54.0)

Replaces collections.isPublic (boolean) with collections.visibility
(private/unlisted/public/followers — same enum recipes use). Two-step
migration (0050 adds+backfills, 0051 drops isPublic) since drizzle-kit's
add+drop-in-one-diff rename heuristic needs an interactive prompt we
can't satisfy here.

New collectionVisibleToViewer(viewerId) in lib/visibility.ts mirrors the
existing recipe helper (author always sees own; public/unlisted visible
to anyone; followers-only via the same user_follows EXISTS pattern) —
used by the collection detail page, its print view, fork, and favorite,
replacing their old `or(isPublic, own)` checks.

Create/edit collection dialogs get the same 4-option visibility select
as the recipe form instead of a public/private checkbox.

Collection PDF export now generates a QR code (qrcode, same as the
recipe PDF) linking to /collections/{id}, shown only when visibility is
public/unlisted — same "would an anonymous scanner actually resolve
this" rule as the recipe QR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/collections/[id]/route.ts

@@ -36,7 +36,7 @@ export async function PUT(req: NextRequest, { params }: Params) {
     description: z.string().max(500).nullable().optional(),
     notes: z.string().max(2000).nullable().optional(),
     tags: z.array(z.string().min(1).max(50)).max(20).optional(),
-    isPublic: z.boolean().optional(),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]).optional(),
     addRecipeId: z.string().optional(),
     addRecipeIds: z.array(z.string()).max(200).optional(),
     removeRecipeId: z.string().optional(),
@@ -45,13 +45,13 @@ export async function PUT(req: NextRequest, { params }: Params) {
   if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
 
   const data = parsed.data;
-  if (data.name || data.description !== undefined || data.notes !== undefined || data.tags !== undefined || data.isPublic !== undefined) {
+  if (data.name || data.description !== undefined || data.notes !== undefined || data.tags !== undefined || data.visibility !== undefined) {
     await db.update(collections).set({
       ...(data.name && { name: data.name }),
       ...(data.description !== undefined && { description: data.description }),
       ...(data.notes !== undefined && { notes: data.notes }),
       ...(data.tags !== undefined && { tags: data.tags }),
-      ...(data.isPublic !== undefined && { isPublic: data.isPublic }),
+      ...(data.visibility !== undefined && { visibility: data.visibility }),
       updatedAt: new Date(),
     }).where(eq(collections.id, id));
   }