Add phase 2: recipes with visibility, photos, search and favourites

- Recipe model with ingredients (amount/range, unit, group, note), steps,
  lowercase tags, author notes, source URL and private/public visibility
- Central RecipeQuerySet.visible_to() used by every read path; edit only
  by owner, delete by owner or admin (visible recipes only)
- Text-based editing: ingredient/step parser with roundtrip and scaling
- Photo upload (JPEG/PNG/WebP/HEIC), re-encoded to WebP without EXIF,
  thumbnails, cover image, served only through permission-checked view
- Search across title, description, ingredients, tags; ingredient and tag
  filters; "mine" and favourites views
- Admin can delete all recipes of a deactivated user
- Acceptance tests: private recipes unreachable for others and admins
  in list, search, tags, favourites, detail, edit, delete and image URLs

Co-Authored-By: Claude Opus 5.5 <[email protected]>

accounts/views.py

@@ -38,7 +38,7 @@ def _safe_next(request):
 @never_cache
 def login_view(request):
     if request.user.is_authenticated:
-        return redirect("core:home")
+        return redirect("recipes:list")
     form = LoginForm(request.POST or None)
     status = 200
     if request.method == "POST" and form.is_valid():
@@ -100,7 +100,7 @@ def register(request, token):
             invitation.save(update_fields=["used_at", "used_by"])
         login(request, user, backend="django.contrib.auth.backends.ModelBackend")
         messages.success(request, "Willkommen im Kochbuch!")
-        return redirect("core:home")
+        return redirect("recipes:list")
     return render(request, "accounts/register.html", {"form": form, "invitation": invitation})
 
 
@@ -126,7 +126,7 @@ def password_reset(request, token):
             reset.save(update_fields=["used_at"])
         login(request, user, backend="django.contrib.auth.backends.ModelBackend")
         messages.success(request, "Dein Passwort wurde geändert.")
-        return redirect("core:home")
+        return redirect("recipes:list")
     return render(request, "accounts/password_reset.html", {"form": form, "reset_user": reset.user})
 
 
@@ -152,5 +152,5 @@ def password_change(request):
         user.save(update_fields=["password", "must_change_password"])
         update_session_auth_hash(request, user)
         messages.success(request, "Dein Passwort wurde geändert.")
-        return redirect("core:home")
+        return redirect("recipes:list")
     return render(request, "accounts/password_change.html", {"form": form, "forced": user.must_change_password})