fix: resolve TODO.md security/perf/test-coverage backlog

Fixes the 13-item codebase health scan backlog: wraps meal-plan
generation in a transaction, adds missing userId/GIN indexes, fixes
an IPv6-parsing gap in the webhook SSRF guard (and an identical
duplicated bug in the AI URL-import path, now consolidated onto one
implementation), paginates the collections list, dedupes the AI
recipe Zod schemas, wires up Stripe tier sync, rate-limits AI key
rotation, gets `pnpm typecheck` actually working, and adds test
coverage for the previously-untested admin/webhooks routes.

Two flagged issues (collection removeRecipeId IDOR, tier-limit race)
turned out to already be fixed/non-issues on inspection — noted in
TODO.md rather than silently dropped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/schema/recipes.ts

@@ -49,6 +49,7 @@ export const recipes = pgTable("recipes", {
 }, (t) => [
   index("recipes_author_idx").on(t.authorId),
   index("recipes_visibility_idx").on(t.visibility),
+  index("recipes_dietary_tags_gin").using("gin", t.dietaryTags),
 ]);
 
 export const ingredients = pgTable("ingredients", {

packages/db/src/schema/social.ts

@@ -25,13 +25,17 @@ export const ratings = pgTable("ratings", {
   reviewText: text("review_text"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
+}, (t) => [
+  index("ratings_user_idx").on(t.userId),
+]);
 
 export const favorites = pgTable("favorites", {
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   recipeId: text("recipe_id").notNull().references(() => recipes.id, { onDelete: "cascade" }),
   createdAt: timestamp("created_at").notNull().defaultNow(),
-});
+}, (t) => [
+  index("favorites_user_idx").on(t.userId),
+]);
 
 export const comments = pgTable("comments", {
   id: text("id").primaryKey(),
@@ -53,7 +57,9 @@ export const collections = pgTable("collections", {
   isPublic: boolean("is_public").notNull().default(false),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
+}, (t) => [
+  index("collections_user_idx").on(t.userId),
+]);
 
 export const collectionRecipes = pgTable("collection_recipes", {
   collectionId: text("collection_id").notNull().references(() => collections.id, { onDelete: "cascade" }),
@@ -68,7 +74,9 @@ export const cookingHistory = pgTable("cooking_history", {
   cookedAt: timestamp("cooked_at").notNull().defaultNow(),
   servings: integer("servings"),
   notes: text("notes"),
-});
+}, (t) => [
+  index("cooking_history_user_idx").on(t.userId),
+]);
 
 export const feedItems = pgTable("feed_items", {
   id: text("id").primaryKey(),
@@ -104,7 +112,9 @@ export const collectionMembers = pgTable("collection_members", {
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   role: collectionMemberRoleEnum("role").notNull().default("viewer"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
-});
+}, (t) => [
+  index("collection_members_user_idx").on(t.userId),
+]);
 
 export const commentReactionTypeEnum = pgEnum("comment_reaction_type", ["like", "love", "laugh", "wow", "sad", "fire"]);
 

packages/db/src/schema/users.ts

@@ -23,6 +23,7 @@ export const users = pgTable("users", {
   username: text("username").unique(),
   role: userRoleEnum("role").notNull().default("user"),
   tier: tierEnum("tier").notNull().default("free"),
+  stripeCustomerId: text("stripe_customer_id").unique(),
   unitPref: unitPrefEnum("unit_pref").notNull().default("metric"),
   locale: text("locale").notNull().default("en"),
   createdAt: timestamp("created_at").notNull().defaultNow(),