feat: per-category email prefs, admin ops webhooks, per-user feature toggles (v0.61.0)

- Notification email preferences: every push category (follow, comment,
  reply, reaction, rating, mention, leftoverExpiring, shoppingList) now has
  an independent email toggle, plus a Weekly Digest toggle. Previously email
  sent unconditionally whenever the recipient had one; now gated the same
  way push already was. The weekly-digest cron route excludes opted-out
  users.

- Admin-only site-wide webhooks (Admin → Webhooks): new signups, support
  tickets, and reports filed can now fire an HMAC-signed HTTP webhook
  (Slack/Discord/ops alerting), independent of the existing per-user
  webhooks (which stay scoped to a user's own recipe/meal-plan/shopping-list
  events). Signing/delivery logic factored into lib/webhook-delivery.ts and
  shared by both dispatchers instead of duplicated.

- Settings → Features: users can hide Nutrition, Pantry, Meal Plan,
  Shopping Lists, Collections, or Messages from their own nav. Purely
  cosmetic — hidden pages stay reachable by direct link, nothing is
  access-restricted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/reports/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { db, reports, comments, recipes, users, eq } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 import { applyRateLimit } from "@/lib/rate-limit";
+import { dispatchAdminWebhook } from "@/lib/admin-webhooks";
 import { randomUUID } from "crypto";
 
 const Schema = z.object({
@@ -33,13 +34,16 @@ export async function POST(req: NextRequest) {
 
   if (!exists) return NextResponse.json({ error: "Target not found" }, { status: 404 });
 
+  const id = randomUUID();
   await db.insert(reports).values({
-    id: randomUUID(),
+    id,
     reporterId: session!.user.id,
     targetType,
     targetId,
     reason,
   });
 
+  void dispatchAdminWebhook("report.filed", { id, reporterId: session!.user.id, targetType, targetId, reason });
+
   return NextResponse.json({ ok: true }, { status: 201 });
 }