feat(ai): Vercel AI SDK provider factory with BYOK and per-use-case model prefs

Provider factory (OpenAI/Anthropic/OpenRouter/Ollama). generateObject for all outputs.
Features: recipe generation, photo-to-recipe vision, variations, drink/meal pairings,
ingredient substitution, recipe adaptation, nutrition analysis, URL import, meal plan gen.
User BYOK keys (AES-256-GCM). Per-use-case model preferences (text/vision/mealPlan).
Site-level key override via admin settings.

apps/web/app/api/v1/ai/substitute/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireSession } from "@/lib/api-auth";
+import { checkTierLimit, incrementUsage } from "@/lib/tiers";
+import { substituteIngredient } from "@/lib/ai/features/substitute-ingredient";
+
+const Schema = z.object({
+  ingredient: z.string().min(1).max(200),
+  recipeTitle: z.string().max(200).optional(),
+  provider: z.enum(["openai", "anthropic", "openrouter", "ollama"]).optional(),
+  model: z.string().optional(),
+});
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
+
+  await checkTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "aiCall");
+
+  const context = parsed.data.recipeTitle
+    ? `recipe "${parsed.data.recipeTitle}"`
+    : "a general recipe";
+
+  const substitutions = await substituteIngredient(
+    parsed.data.ingredient,
+    context,
+    { provider: parsed.data.provider, model: parsed.data.model }
+  );
+
+  await incrementUsage(session!.user.id, "aiCall");
+  return NextResponse.json({ substitutions });
+}