feat: collections overhaul — reorder, search, edit/delete, tags (v0.53.0)

Seven related improvements to collections:

- Drag-and-drop reorder (dnd-kit, same pattern as the shopping list) — new
  collection_recipes.position column (migration 0049, backfilled from
  existing added_at order so nothing jumps around on upgrade).
- Search collections by name/description (server-side, list page) and
  search recipes within a collection (client-side filter, already loaded).
- Edit collection: name/description/tags/private notes via a new dialog;
  new collections.notes + collections.tags columns.
- Delete collection with a choice to also delete its recipes — only ones
  the deleting user actually owns, never recipes shared in by others.
- Collection detail (both owner and public view) now renders the same
  RecipeGridCard used on /recipes, instead of the older, plainer RecipeCard.
- Collection list cards redesigned — photo-collage preview (first 4 recipe
  covers/placeholders), tag badges, cleaner layout.
- Fixed the recipe count shown on a collection card: the query capped the
  `recipes` relation at 1 for thumbnail purposes and then read `.length`
  off that same capped array, so it never showed more than 1. Now a
  proper grouped count query, separate from the thumbnail fetch.

New/changed endpoints documented in OpenAPI: PATCH /collections/{id}/reorder,
DELETE /collections/{id}?deleteRecipes, PUT /collections/{id}'s new
notes/tags fields.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/collections/[id]/reorder/route.ts

@@ -0,0 +1,44 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, collections, collectionRecipes, eq, and, inArray } from "@epicure/db";
+import { requireSessionOrApiKey } from "@/lib/api-auth";
+
+type Params = { params: Promise<{ id: string }> };
+
+const Schema = z.object({
+  recipeIds: z.array(z.string()).min(1).max(500),
+});
+
+export async function PATCH(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req);
+  if (response) return response;
+  const { id } = await params;
+
+  const existing = await db.query.collections.findFirst({
+    where: and(eq(collections.id, id), eq(collections.userId, session!.user.id)),
+  });
+  if (!existing) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+
+  const current = await db.query.collectionRecipes.findMany({
+    where: eq(collectionRecipes.collectionId, id),
+    columns: { recipeId: true },
+  });
+  const currentIds = new Set(current.map((r) => r.recipeId));
+  const requestedIds = parsed.data.recipeIds.filter((rid) => currentIds.has(rid));
+  if (requestedIds.length === 0) return NextResponse.json({ error: "No matching recipes in this collection" }, { status: 400 });
+
+  await db.transaction(async (tx) => {
+    for (let i = 0; i < requestedIds.length; i++) {
+      await tx
+        .update(collectionRecipes)
+        .set({ position: i })
+        .where(and(eq(collectionRecipes.collectionId, id), inArray(collectionRecipes.recipeId, [requestedIds[i]!])));
+    }
+  });
+
+  return NextResponse.json({ ok: true });
+}