feat: collections visibility enum (matches recipes) + QR on collection PDF (v0.54.0)

Replaces collections.isPublic (boolean) with collections.visibility
(private/unlisted/public/followers — same enum recipes use). Two-step
migration (0050 adds+backfills, 0051 drops isPublic) since drizzle-kit's
add+drop-in-one-diff rename heuristic needs an interactive prompt we
can't satisfy here.

New collectionVisibleToViewer(viewerId) in lib/visibility.ts mirrors the
existing recipe helper (author always sees own; public/unlisted visible
to anyone; followers-only via the same user_follows EXISTS pattern) —
used by the collection detail page, its print view, fork, and favorite,
replacing their old `or(isPublic, own)` checks.

Create/edit collection dialogs get the same 4-option visibility select
as the recipe form instead of a public/private checkbox.

Collection PDF export now generates a QR code (qrcode, same as the
recipe PDF) linking to /collections/{id}, shown only when visibility is
public/unlisted — same "would an anonymous scanner actually resolve
this" rule as the recipe QR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/visibility.ts

@@ -1,4 +1,4 @@
-import { recipes, eq, or, and, inArray, sql } from "@epicure/db";
+import { recipes, collections, eq, or, and, inArray, sql } from "@epicure/db";
 
 /**
  * Drizzle condition: true when `viewerId` may view a given recipe row — the
@@ -25,3 +25,15 @@ export function visibleToViewer(viewerId: string) {
     )
   );
 }
+
+/** Same rationale/pattern as visibleToViewer(), for collections. */
+export function collectionVisibleToViewer(viewerId: string) {
+  return or(
+    eq(collections.userId, viewerId),
+    inArray(collections.visibility, ["public", "unlisted"]),
+    and(
+      eq(collections.visibility, "followers"),
+      sql`exists (select 1 from user_follows where user_follows.follower_id = ${viewerId} and user_follows.following_id = ${collections.userId})`
+    )
+  );
+}