perf: drop redundant JSON.parse(JSON.stringify()) in recipe API

Every recipe list endpoint wrapped its result in
`JSON.parse(JSON.stringify(...))` before handing it to `json()`, which
then serialises again — a full extra stringify+parse cycle per response.
`lean()` already returns plain objects and ObjectIds/Dates serialise
correctly through `json()`'s single `JSON.stringify`, so the extra round
trip was pure waste.

Removed from the 9 output-side call sites (all_brief, category,
category/[cat], tag, tag/[tag], icon, icon/[icon], in_season/[month],
search, favorites/recipes, offline-db, translate/untranslated).
Kept the two deep-clone-before-mutation usages in items/[name] and
json-ld/[name] — those are load-bearing.

Shuffle stays server-side: moving it to the client would need a hero
preload + hydration rework that's bigger than a perf tweak.

TODO.md

@@ -6,7 +6,7 @@ Order = impact. Font items + app.html preload intentionally skipped.
 
 - [x] 1. Lucide subpath imports — convert `from '@lucide/svelte'` barrel imports to `@lucide/svelte/icons/<kebab-name>` so Vite tree-shakes per-icon (current 748 KB shared chunk)
 - [x] 2. Chart.js dynamic import in `FitnessChart.svelte` (drop 244 KB from non-stats fitness routes)
-- [ ] 3. Recipe `all_brief` endpoint — drop `JSON.parse(JSON.stringify(...))`, move shuffle client-side, enable caching
+- [x] 3. Recipe API endpoints — drop `JSON.parse(JSON.stringify(...))` double-serialize (9 endpoints). Client-side shuffle / cache headers deferred (would require rethinking hero preload + hydration)
 - [ ] 4. Favorites page — drop unnecessary `all_brief` fetch (verify consumer first)
 - [ ] 5. Replace redundant `locals.auth()` with `locals.session` across recipe/calendar/fitness loaders
 - [ ] 6. Stream fitness stats loader — return promises for slow panels