feat: direct messages

1:1 conversations (userAId < userBId dedup pair), messages,
per-participant read tracking (conversation_reads). Block relationship
is enforced on every send. UI: /messages list + /messages/[id] thread
(5s poll), MessageButton on profiles, unread-badged nav icon.

This completes the social-feature backlog: notifications, rate
limiting, blocking, reporting, search/discovery, mentions, DMs, plus
fixes for the recipe-visibility 404, follow race, and 2-level comment
thread cap found during the earlier audit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/messages/[id]/page.tsx

@@ -0,0 +1,44 @@
+import { notFound } from "next/navigation";
+import { headers } from "next/headers";
+import Link from "next/link";
+import { auth } from "@/lib/auth/server";
+import { db, conversations, users, eq } from "@epicure/db";
+import { ConversationsList } from "@/components/social/conversations-list";
+import { MessageThread } from "@/components/social/message-thread";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { isParticipant, otherParticipantId } from "@/lib/messaging";
+
+type Params = { params: Promise<{ id: string }> };
+
+export default async function ConversationPage({ params }: Params) {
+  const { id } = await params;
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) return null;
+
+  const conversation = await db.query.conversations.findFirst({ where: eq(conversations.id, id) });
+  if (!conversation || !isParticipant(conversation, session.user.id)) notFound();
+
+  const otherId = otherParticipantId(conversation, session.user.id);
+  const other = await db.query.users.findFirst({ where: eq(users.id, otherId) });
+  if (!other) notFound();
+
+  return (
+    <div className="max-w-5xl mx-auto h-[calc(100vh-8rem)] border rounded-xl overflow-hidden flex">
+      <div className="hidden sm:block w-80 border-r shrink-0 overflow-y-auto">
+        <ConversationsList />
+      </div>
+      <div className="flex-1 flex flex-col min-w-0">
+        <div className="border-b p-3 flex items-center gap-3">
+          <Link href={`/u/${other.username}`} className="flex items-center gap-3">
+            <Avatar className="h-8 w-8">
+              {other.avatarUrl && <AvatarImage src={other.avatarUrl} />}
+              <AvatarFallback className="text-xs">{other.name.slice(0, 2).toUpperCase()}</AvatarFallback>
+            </Avatar>
+            <span className="font-medium text-sm hover:underline">{other.name}</span>
+          </Link>
+        </div>
+        <MessageThread conversationId={id} currentUserId={session.user.id} />
+      </div>
+    </div>
+  );
+}

apps/web/app/(app)/messages/page.tsx

@@ -0,0 +1,21 @@
+import type { Metadata } from "next";
+import { MessageCircle } from "lucide-react";
+import { ConversationsList } from "@/components/social/conversations-list";
+
+export const metadata: Metadata = { title: "Messages — Epicure" };
+
+export default function MessagesPage() {
+  return (
+    <div className="max-w-5xl mx-auto h-[calc(100vh-8rem)] border rounded-xl overflow-hidden flex">
+      <div className="w-full sm:w-80 border-r shrink-0 overflow-y-auto">
+        <ConversationsList />
+      </div>
+      <div className="hidden sm:flex flex-1 items-center justify-center text-muted-foreground">
+        <div className="text-center space-y-2">
+          <MessageCircle className="h-10 w-10 mx-auto opacity-50" />
+          <p className="text-sm">Select a conversation</p>
+        </div>
+      </div>
+    </div>
+  );
+}

apps/web/app/(app)/u/[username]/page.tsx

@@ -17,6 +17,7 @@ import { Avatar, AvatarImage, AvatarFallback } from "@/components/ui/avatar";
 import { Badge } from "@/components/ui/badge";
 import { FollowButton } from "@/components/social/follow-button";
 import { BlockButton } from "@/components/social/block-button";
+import { MessageButton } from "@/components/social/message-button";
 import { getPublicUrl } from "@/lib/storage";
 
 type Params = { params: Promise<{ username: string }> };
@@ -113,6 +114,7 @@ export default async function UserProfilePage({ params }: Params) {
                   targetUsername={user.username!}
                   initialFollowing={isFollowing}
                 />
+                {!isBlocked && <MessageButton targetUsername={user.username!} />}
                 <BlockButton targetUsername={user.username!} initialBlocked={isBlocked} />
               </div>
             )}