Add phase 2: recipes with visibility, photos, search and favourites

- Recipe model with ingredients (amount/range, unit, group, note), steps,
  lowercase tags, author notes, source URL and private/public visibility
- Central RecipeQuerySet.visible_to() used by every read path; edit only
  by owner, delete by owner or admin (visible recipes only)
- Text-based editing: ingredient/step parser with roundtrip and scaling
- Photo upload (JPEG/PNG/WebP/HEIC), re-encoded to WebP without EXIF,
  thumbnails, cover image, served only through permission-checked view
- Search across title, description, ingredients, tags; ingredient and tag
  filters; "mine" and favourites views
- Admin can delete all recipes of a deactivated user
- Acceptance tests: private recipes unreachable for others and admins
  in list, search, tags, favourites, detail, edit, delete and image URLs

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CLAUDE.md

@@ -6,15 +6,16 @@ port; TLS, domain and proxy are out of scope.
 
 ## Status
 - [x] Phase 1: Docker setup, DB, auth with invitations, roles
-- [ ] Phase 2: Recipes CRUD, visibility (private/public), photos, notes, search, favourites
+- [x] Phase 2: Recipes CRUD, visibility (private/public), photos, notes, search, favourites
 - [ ] Phase 3: Comments, serving calculator, cooking mode (wake lock)
 - [ ] Phase 4: AI (OpenAI): clean up manual input + photo/screenshot import
 - [ ] Phase 5: Link import (schema.org JSON-LD, Instagram with paste fallback, Android PWA share target)
 - [ ] Phase 6: Backup script, full README
 
 ## Stack
-Django 5.2 LTS (Python 3.12), server-rendered templates, HTMX planned for Phase 2+, PostgreSQL 17,
-gunicorn (gthread), WhiteNoise for static files. No Redis, no JS build step.
+Django 5.2 LTS (Python 3.12), server-rendered templates, PostgreSQL 17,
+gunicorn (gthread), WhiteNoise for static files, Pillow + pillow-heif for photos. No Redis, no HTMX,
+no JS build step: plain forms with small progressive enhancements in `static/js/app.js`.
 
 ## Layout
 - `config/` – settings (all env-driven, see `.env.example`), urls, wsgi. `settings_test.py` for pytest.
@@ -24,6 +25,11 @@ gunicorn (gthread), WhiteNoise for static files. No Redis, no JS build step.
 - `accounts/` – custom `User` (e-mail login, `role` = user|admin), `Invitation`, `PasswordResetToken`,
   login/registration/reset views, admin area (`admin_views.py`, `/verwaltung/…`),
   `ensure_admin` management command (first admin from env).
+- `recipes/` – `Recipe` (+ `Ingredient`, `Step`, `Tag`, `RecipeImage`, `Favorite`). `RecipeQuerySet.visible_to/
+  editable_by/deletable_by/search` hold all access rules. `parsing.py` converts the text form fields
+  (one ingredient per line, `Gruppe:` headers, steps separated by blank lines) to structured data and
+  scales amounts. `images.py` validates/re-encodes uploads (WebP 1600 px + 480 px thumb, no EXIF).
+  Photos are served only via `recipes:photo` (`/bilder/<uuid>/<gross|klein>.webp`) after a visibility check.
 - `templates/`, `static/` – global templates, `app.css` (mobile first, dark mode), `app.js`.
 - `docker/entrypoint.sh` – migrate → ensure_admin → purge_ratelimits → gunicorn.
 - `scripts/` – `init-env.sh` (creates .env with secrets), `dev_server.py` (local run without Docker).