fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/collections/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { db, collections, eq, desc } from "@epicure/db";
+import { db, collections, eq, desc, sql } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 
 const Schema = z.object({
@@ -9,17 +9,42 @@ const Schema = z.object({
   isPublic: z.boolean().default(false),
 });
 
-export async function GET(_req: NextRequest) {
+export async function GET(req: NextRequest) {
   const { session, response } = await requireSession();
   if (response) return response;
 
-  const rows = await db.query.collections.findMany({
-    where: eq(collections.userId, session!.user.id),
-    orderBy: desc(collections.updatedAt),
-    with: { recipes: { limit: 4, with: { recipe: { with: { photos: true } } } } },
-  });
+  const { searchParams } = req.nextUrl;
 
-  return NextResponse.json(rows);
+  const limitRaw = searchParams.get("limit");
+  const limit = Math.min(
+    limitRaw !== null && !Number.isNaN(Number(limitRaw))
+      ? Math.max(1, Number(limitRaw))
+      : 20,
+    50
+  );
+
+  const offsetRaw = searchParams.get("offset");
+  const offset =
+    offsetRaw !== null && !Number.isNaN(Number(offsetRaw))
+      ? Math.max(0, Number(offsetRaw))
+      : 0;
+
+  const where = eq(collections.userId, session!.user.id);
+
+  const [rows, countResult] = await Promise.all([
+    db.query.collections.findMany({
+      where,
+      orderBy: desc(collections.updatedAt),
+      with: { recipes: { limit: 4, with: { recipe: { with: { photos: true } } } } },
+      limit,
+      offset,
+    }),
+    db.select({ total: sql<number>`count(*)::int` }).from(collections).where(where),
+  ]);
+
+  const total = countResult[0]?.total ?? 0;
+
+  return NextResponse.json({ data: rows, total, limit, offset });
 }
 
 export async function POST(req: NextRequest) {