Add collection endpoints #1152

Goal

Add API endpoints for listing and browsing collections, and admin endpoints for creating and managing them.

Spec reference

docs/specs/recipe-creation-target-architecture.md — §"Collection endpoints"

Implementation notes

• GET /api/collection — list available collections (authenticated; returns all curated collections)
• GET /api/collection/{collectionId} — collection detail with ordered recipe items
• POST /api/collection — admin only (requires recipe:publish permission); create collection
• PUT /api/collection/{collectionId} — admin only; update title, summary, and ordered item list
• DTOs: CollectionListItem, CollectionDetail, CollectionRecipeItem

Acceptance criteria

• List and detail endpoints accessible to all authenticated users
• Create/update endpoints return 403 for non-admins

Testing

• Integration tests: list, detail, create (admin), create (non-admin 403)

Part of#1107