fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/__tests__/webhooks.test.ts

@@ -22,7 +22,7 @@ vi.mock("@epicure/db", () => ({
 
 let fetchCalls: { url: string; body: string; headers: Record<string, string> }[] = [];
 
-global.fetch = vi.fn(async (url: RequestInfo, init?: RequestInit) => {
+global.fetch = vi.fn(async (url: RequestInfo | URL, init?: RequestInit) => {
   const body = (init?.body as string) ?? "";
   fetchCalls.push({
     url: url as string,
@@ -38,7 +38,7 @@ beforeEach(() => {
   fetchCalls = [];
   vi.clearAllMocks();
   mockInsert.mockReturnValue({ values: mockInsertValues });
-  global.fetch = vi.fn(async (url: RequestInfo, init?: RequestInit) => {
+  global.fetch = vi.fn(async (url: RequestInfo | URL, init?: RequestInit) => {
     const body = (init?.body as string) ?? "";
     fetchCalls.push({
       url: url as string,