feat: collections visibility enum (matches recipes) + QR on collection PDF (v0.54.0)

Replaces collections.isPublic (boolean) with collections.visibility
(private/unlisted/public/followers — same enum recipes use). Two-step
migration (0050 adds+backfills, 0051 drops isPublic) since drizzle-kit's
add+drop-in-one-diff rename heuristic needs an interactive prompt we
can't satisfy here.

New collectionVisibleToViewer(viewerId) in lib/visibility.ts mirrors the
existing recipe helper (author always sees own; public/unlisted visible
to anyone; followers-only via the same user_follows EXISTS pattern) —
used by the collection detail page, its print view, fork, and favorite,
replacing their old `or(isPublic, own)` checks.

Create/edit collection dialogs get the same 4-option visibility select
as the recipe form instead of a public/private checkbox.

Collection PDF export now generates a QR code (qrcode, same as the
recipe PDF) linking to /collections/{id}, shown only when visibility is
public/unlisted — same "would an anonymous scanner actually resolve
this" rule as the recipe QR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/collections/route.ts

@@ -6,7 +6,7 @@ import { requireSessionOrApiKey } from "@/lib/api-auth";
 const Schema = z.object({
   name: z.string().min(1).max(100),
   description: z.string().max(500).optional(),
-  isPublic: z.boolean().default(false),
+  visibility: z.enum(["private", "unlisted", "public", "followers"]).default("private"),
 });
 
 export async function GET(req: NextRequest) {
@@ -61,7 +61,7 @@ export async function POST(req: NextRequest) {
     userId: session!.user.id,
     name: parsed.data.name,
     description: parsed.data.description,
-    isPublic: parsed.data.isPublic,
+    visibility: parsed.data.visibility,
   });
 
   return NextResponse.json({ id }, { status: 201 });