fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/recipes/[id]/rate/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { db, recipes, ratings, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 import { createNotification } from "@/lib/notifications";
+import { isOwnedReviewPhotoKey } from "@/lib/storage";
 
 const Schema = z.object({
   score: z.number().int().min(1).max(5),
@@ -29,6 +30,10 @@ export async function POST(req: NextRequest, { params }: Params) {
   const parsed = Schema.safeParse(body);
   if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
 
+  if (parsed.data.photoKey && !isOwnedReviewPhotoKey(parsed.data.photoKey, id, session!.user.id)) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photoKey"], message: "Photo key not issued for this review" }] }, { status: 400 });
+  }
+
   const existing = await db.query.ratings.findFirst({
     where: and(eq(ratings.recipeId, id), eq(ratings.userId, session!.user.id)),
   });