Add phase 2: recipes with visibility, photos, search and favourites

- Recipe model with ingredients (amount/range, unit, group, note), steps,
  lowercase tags, author notes, source URL and private/public visibility
- Central RecipeQuerySet.visible_to() used by every read path; edit only
  by owner, delete by owner or admin (visible recipes only)
- Text-based editing: ingredient/step parser with roundtrip and scaling
- Photo upload (JPEG/PNG/WebP/HEIC), re-encoded to WebP without EXIF,
  thumbnails, cover image, served only through permission-checked view
- Search across title, description, ingredients, tags; ingredient and tag
  filters; "mine" and favourites views
- Admin can delete all recipes of a deactivated user
- Acceptance tests: private recipes unreachable for others and admins
  in list, search, tags, favourites, detail, edit, delete and image URLs

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/test_admin_permissions.py

@@ -52,7 +52,7 @@ def test_deactivated_user_session_ends(admin_client, user):
     session = Client()
     session.force_login(user)
     admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "deactivate"]))
-    assert session.get(reverse("core:home")).status_code == 302
+    assert session.get(reverse("recipes:list")).status_code == 302
 
 
 def test_admin_cannot_demote_or_deactivate_self(admin_client, admin_user):