Add recipe:publish permission and admin publication endpoints #1135

Goal

Allow users with the recipe:publish permission to publish and unpublish recipes, making them visible at their public slug URL.

Spec reference

docs/specs/recipe-creation-target-architecture.md — §"Access and publication model – Admin publication control"

Implementation notes

• Auth0 permission recipe:publish; add a corresponding ASP.NET Core authorization policy
• PUT /api/recipe/{recipeId}/publication (admin only):
  • Publish action: creates or reactivates RecipePublication row with generated slug; emits RecipePublished outbox event
  • Unpublish action: sets UnpublishedAtUtc/UnpublishedByUserId; emits RecipeUnpublished outbox event
  • Request body: { action: "publish" | "unpublish" }
• Extend search projection consumer (from E5.4) to handle RecipePublished and RecipeUnpublished events: update IsPublishedExternally field on RecipeSearchIndex row
• 403 for callers without recipe:publish; 404 if recipe not found

Acceptance criteria

• Publish creates RecipePublication row and emits outbox event
• Unpublish sets UnpublishedAtUtc and emits outbox event
• RecipeSearchIndex.IsPublishedExternally updated by consumer after event processed
• Non-admin 403

Testing

• Integration tests: publish success, unpublish success, non-admin 403
• Integration test: search index IsPublishedExternally updated after consumer cycle

Part of#1103