feat: per-category email prefs, admin ops webhooks, per-user feature toggles (v0.61.0)

- Notification email preferences: every push category (follow, comment,
  reply, reaction, rating, mention, leftoverExpiring, shoppingList) now has
  an independent email toggle, plus a Weekly Digest toggle. Previously email
  sent unconditionally whenever the recipient had one; now gated the same
  way push already was. The weekly-digest cron route excludes opted-out
  users.

- Admin-only site-wide webhooks (Admin → Webhooks): new signups, support
  tickets, and reports filed can now fire an HMAC-signed HTTP webhook
  (Slack/Discord/ops alerting), independent of the existing per-user
  webhooks (which stay scoped to a user's own recipe/meal-plan/shopping-list
  events). Signing/delivery logic factored into lib/webhook-delivery.ts and
  shared by both dispatchers instead of duplicated.

- Settings → Features: users can hide Nutrition, Pantry, Meal Plan,
  Shopping Lists, Collections, or Messages from their own nav. Purely
  cosmetic — hidden pages stay reachable by direct link, nothing is
  access-restricted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/admin-webhooks.ts

@@ -0,0 +1,38 @@
+import crypto from "crypto";
+import { db } from "@epicure/db";
+import { adminWebhooks, adminWebhookDeliveries } from "@epicure/db";
+import { eq } from "@epicure/db";
+import { deliverWebhook } from "@/lib/webhook-delivery";
+
+// Site-wide ops events — distinct from WEBHOOK_EVENTS in lib/webhooks.ts,
+// which are per-user events on a user's own data. These fire regardless of
+// who's involved, for ops alerting (Slack/Discord/etc via a generic
+// incoming webhook), so only admins can subscribe to them.
+export const ADMIN_WEBHOOK_EVENTS = [
+  "user.signed_up",
+  "support_ticket.created",
+  "report.filed",
+] as const;
+
+export type AdminWebhookEvent = (typeof ADMIN_WEBHOOK_EVENTS)[number];
+
+export async function dispatchAdminWebhook(event: AdminWebhookEvent, payload: object) {
+  const hooks = await db.select().from(adminWebhooks).where(eq(adminWebhooks.active, true));
+  const filtered = hooks.filter((h) => h.events.length === 0 || h.events.includes(event));
+
+  await Promise.allSettled(
+    filtered.map(async (hook) => {
+      const { statusCode, success } = await deliverWebhook(hook.url, hook.secret, event, payload);
+      await db.insert(adminWebhookDeliveries).values({
+        id: crypto.randomUUID(),
+        webhookId: hook.id,
+        event,
+        payload: payload as Record<string, unknown>,
+        statusCode,
+        success,
+        attempts: 1,
+        createdAt: new Date(),
+      });
+    })
+  );
+}