feat: per-category email prefs, admin ops webhooks, per-user feature toggles (v0.61.0)

- Notification email preferences: every push category (follow, comment,
  reply, reaction, rating, mention, leftoverExpiring, shoppingList) now has
  an independent email toggle, plus a Weekly Digest toggle. Previously email
  sent unconditionally whenever the recipient had one; now gated the same
  way push already was. The weekly-digest cron route excludes opted-out
  users.

- Admin-only site-wide webhooks (Admin → Webhooks): new signups, support
  tickets, and reports filed can now fire an HMAC-signed HTTP webhook
  (Slack/Discord/ops alerting), independent of the existing per-user
  webhooks (which stay scoped to a user's own recipe/meal-plan/shopping-list
  events). Signing/delivery logic factored into lib/webhook-delivery.ts and
  shared by both dispatchers instead of duplicated.

- Settings → Features: users can hide Nutrition, Pantry, Meal Plan,
  Shopping Lists, Collections, or Messages from their own nav. Purely
  cosmetic — hidden pages stay reachable by direct link, nothing is
  access-restricted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/webhooks.ts

@@ -2,17 +2,7 @@ import crypto from "crypto";
 import { db } from "@epicure/db";
 import { webhooks, webhookDeliveries } from "@epicure/db";
 import { eq, and } from "@epicure/db";
-import { safeFetch } from "@/lib/validate-webhook-url";
-import { decrypt } from "@/lib/encrypt";
-
-// Secrets created before encryption-at-rest was added are a bare 64-char hex
-// string (crypto.randomBytes(32).toString("hex")) with no ":" separators —
-// encrypt()'s output is always "iv:authTag:ciphertext". Fall back to treating
-// the value as already-plaintext rather than a hard migration, since this is
-// only reached with a value this app itself generated (never user input).
-function decryptWebhookSecret(stored: string): string {
-  return stored.split(":").length === 3 ? decrypt(stored) : stored;
-}
+import { deliverWebhook } from "@/lib/webhook-delivery";
 
 export const WEBHOOK_EVENTS = [
   "recipe.created",
@@ -36,29 +26,7 @@ export async function dispatchWebhook(userId: string, event: WebhookEvent, paylo
 
   await Promise.allSettled(
     filtered.map(async (hook) => {
-      const body = JSON.stringify({ event, payload, timestamp: new Date().toISOString() });
-      const sig = crypto.createHmac("sha256", decryptWebhookSecret(hook.secret)).update(body).digest("hex");
-      let statusCode = 0;
-      let success = false;
-      try {
-        // safeFetch resolves and pins the connection to a single validated IP
-        // (and re-validates + re-pins every redirect hop), so there's no
-        // separate re-resolution for a rebinding attack to exploit.
-        const res = await safeFetch(hook.url, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "X-Epicure-Signature": `sha256=${sig}`,
-            "X-Epicure-Event": event,
-          },
-          body,
-          signal: AbortSignal.timeout(10000),
-        });
-        statusCode = res.status;
-        success = res.ok;
-      } catch {
-        // delivery failed; statusCode stays 0, success stays false
-      }
+      const { statusCode, success } = await deliverWebhook(hook.url, hook.secret, event, payload);
       await db.insert(webhookDeliveries).values({
         id: crypto.randomUUID(),
         webhookId: hook.id,