Add phase 2: recipes with visibility, photos, search and favourites

- Recipe model with ingredients (amount/range, unit, group, note), steps,
  lowercase tags, author notes, source URL and private/public visibility
- Central RecipeQuerySet.visible_to() used by every read path; edit only
  by owner, delete by owner or admin (visible recipes only)
- Text-based editing: ingredient/step parser with roundtrip and scaling
- Photo upload (JPEG/PNG/WebP/HEIC), re-encoded to WebP without EXIF,
  thumbnails, cover image, served only through permission-checked view
- Search across title, description, ingredients, tags; ingredient and tag
  filters; "mine" and favourites views
- Admin can delete all recipes of a deactivated user
- Acceptance tests: private recipes unreachable for others and admins
  in list, search, tags, favourites, detail, edit, delete and image URLs

Co-Authored-By: Claude Opus 5.5 <[email protected]>

accounts/admin_views.py

@@ -103,6 +103,25 @@ def user_action(request, pk, action):
     return redirect("accounts:admin_users")
 
 
+@admin_required
+@never_cache
+def user_delete_recipes(request, pk):
+    """Delete all recipes of a deactivated user, including private ones (content is never shown)."""
+    from recipes.models import Recipe
+    from recipes.views import delete_recipe
+
+    target = get_object_or_404(User, pk=pk, is_active=False)
+    recipes = Recipe.objects.filter(owner=target)
+    if request.method == "POST":
+        count = 0
+        for recipe in recipes:
+            delete_recipe(recipe)
+            count += 1
+        messages.success(request, f"{count} Rezepte von {target} gelöscht.")
+        return redirect("accounts:admin_users")
+    return render(request, "accounts/admin/delete_recipes.html", {"target": target, "count": recipes.count()})
+
+
 @admin_required
 @never_cache
 def invitation_list(request):