fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/recipes/[id]/route.ts

@@ -3,7 +3,7 @@ import { db, recipes, recipeIngredients, recipeSteps, recipePhotos, recipeBatchD
 import { eq, and, max, isNotNull } from "@epicure/db";
 import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
-import { deleteObject } from "@/lib/storage";
+import { deleteObject, isOwnedRecipePhotoKey } from "@/lib/storage";
 import { dispatchWebhook } from "@/lib/webhooks";
 import { parseQuantity } from "@/lib/parse-quantity";
 import { extractIngredientQuantity } from "@/lib/extract-ingredient-quantity";
@@ -106,6 +106,10 @@ export async function PUT(req: NextRequest, { params }: Params) {
 
   const data = parsed.data;
 
+  if (data.photos?.some((p) => !isOwnedRecipePhotoKey(p.key, id, session!.user.id))) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photos"], message: "Photo key not issued for this recipe" }] }, { status: 400 });
+  }
+
   await db.transaction(async (tx) => {
     // Create a snapshot of the current state before updating
     const [maxVersionRow] = await tx