Add phase 2: recipes with visibility, photos, search and favourites

- Recipe model with ingredients (amount/range, unit, group, note), steps,
  lowercase tags, author notes, source URL and private/public visibility
- Central RecipeQuerySet.visible_to() used by every read path; edit only
  by owner, delete by owner or admin (visible recipes only)
- Text-based editing: ingredient/step parser with roundtrip and scaling
- Photo upload (JPEG/PNG/WebP/HEIC), re-encoded to WebP without EXIF,
  thumbnails, cover image, served only through permission-checked view
- Search across title, description, ingredients, tags; ingredient and tag
  filters; "mine" and favourites views
- Admin can delete all recipes of a deactivated user
- Acceptance tests: private recipes unreachable for others and admins
  in list, search, tags, favourites, detail, edit, delete and image URLs

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/test_auth.py

@@ -30,7 +30,7 @@ def test_login_with_valid_credentials(user):
     client = Client()
     response = login(client, "[email protected]", PASSWORD)  # e-mail is case-insensitive
     assert response.status_code == 302
-    assert client.get(reverse("core:home")).status_code == 200
+    assert client.get(reverse("recipes:list")).status_code == 200
 
 
 def test_login_wrong_password_gives_generic_error(user):
@@ -89,13 +89,13 @@ def test_login_redirect_rejects_external_next(user):
         {"email": user.email, "password": PASSWORD, "next": "https://evil.example/"},
     )
     assert response.status_code == 302
-    assert response["Location"] == reverse("core:home")
+    assert response["Location"] == reverse("recipes:list")
 
 
 def test_logout_requires_post(user_client):
     assert user_client.get(reverse("accounts:logout")).status_code == 405
     assert user_client.post(reverse("accounts:logout")).status_code == 302
-    assert user_client.get(reverse("core:home")).status_code == 302
+    assert user_client.get(reverse("recipes:list")).status_code == 302
 
 
 def test_login_requires_csrf_token(user):
@@ -145,7 +145,7 @@ def test_register_with_valid_invitation(admin_user):
     assert new_user.role == User.Role.USER
     invitation.refresh_from_db()
     assert invitation.used_by == new_user and invitation.status == "used"
-    assert client.get(reverse("core:home")).status_code == 200
+    assert client.get(reverse("recipes:list")).status_code == 200
 
 
 def test_invitation_is_single_use(admin_user):
@@ -243,7 +243,7 @@ def test_reset_link_ends_existing_sessions(admin_user, user):
         reverse("accounts:password_reset", args=[token_from(link)]),
         {"password1": NEW_PASSWORD, "password2": NEW_PASSWORD},
     )
-    assert old_session.get(reverse("core:home")).status_code == 302
+    assert old_session.get(reverse("recipes:list")).status_code == 302
 
 
 def test_temp_password_forces_change(admin_client, user):
@@ -252,9 +252,9 @@ def test_temp_password_forces_change(admin_client, user):
     client = Client()
     assert login(client, user.email, temp).status_code == 302
     # Every page redirects to the password change until a new password is set.
-    assert client.get(reverse("core:home"))["Location"] == reverse("accounts:password_change")
+    assert client.get(reverse("recipes:list"))["Location"] == reverse("accounts:password_change")
     client.post(reverse("accounts:password_change"), {"password1": NEW_PASSWORD, "password2": NEW_PASSWORD})
-    assert client.get(reverse("core:home")).status_code == 200
+    assert client.get(reverse("recipes:list")).status_code == 200
     user.refresh_from_db()
     assert not user.must_change_password and user.check_password(NEW_PASSWORD)