feat: per-category email prefs, admin ops webhooks, per-user feature toggles (v0.61.0)

- Notification email preferences: every push category (follow, comment,
  reply, reaction, rating, mention, leftoverExpiring, shoppingList) now has
  an independent email toggle, plus a Weekly Digest toggle. Previously email
  sent unconditionally whenever the recipient had one; now gated the same
  way push already was. The weekly-digest cron route excludes opted-out
  users.

- Admin-only site-wide webhooks (Admin → Webhooks): new signups, support
  tickets, and reports filed can now fire an HMAC-signed HTTP webhook
  (Slack/Discord/ops alerting), independent of the existing per-user
  webhooks (which stay scoped to a user's own recipe/meal-plan/shopping-list
  events). Signing/delivery logic factored into lib/webhook-delivery.ts and
  shared by both dispatchers instead of duplicated.

- Settings → Features: users can hide Nutrition, Pantry, Meal Plan,
  Shopping Lists, Collections, or Messages from their own nav. Purely
  cosmetic — hidden pages stay reachable by direct link, nothing is
  access-restricted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/admin/webhooks/[id]/redeliver/route.ts

@@ -0,0 +1,31 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, adminWebhooks, adminWebhookDeliveries, eq, and } from "@epicure/db";
+import { requireAdmin } from "@/lib/api-auth";
+import { dispatchAdminWebhook, type AdminWebhookEvent } from "@/lib/admin-webhooks";
+
+const Schema = z.object({ deliveryId: z.string().uuid() });
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function POST(req: NextRequest, { params }: Params) {
+  const { response } = await requireAdmin();
+  if (response) return response;
+
+  const { id } = await params;
+
+  const hook = await db.query.adminWebhooks.findFirst({ where: eq(adminWebhooks.id, id), columns: { id: true } });
+  if (!hook) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const body = Schema.safeParse(await req.json());
+  if (!body.success) return NextResponse.json({ error: "Validation error", issues: body.error.issues }, { status: 400 });
+
+  const delivery = await db.query.adminWebhookDeliveries.findFirst({
+    where: and(eq(adminWebhookDeliveries.id, body.data.deliveryId), eq(adminWebhookDeliveries.webhookId, id)),
+  });
+  if (!delivery) return NextResponse.json({ error: "Delivery not found" }, { status: 404 });
+
+  void dispatchAdminWebhook(delivery.event as AdminWebhookEvent, (delivery.payload ?? {}) as object);
+
+  return NextResponse.json({ ok: true });
+}