feat: add "cooked it" photo reviews

Users can rate a recipe with review text and an optional photo. Adds
ratings.photo_key column, a reviews list endpoint, and a review-purpose
presign path (reviewer isn't the recipe owner, so the upload
authorization differs from cover-photo uploads).

Also fixes CSP connect-src/img-src to allow the storage origin —
direct-to-S3/MinIO presigned uploads and stored images were silently
blocked by Content-Security-Policy in the browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/recipes/[id]/rate/route.ts

@@ -7,6 +7,7 @@ import { createNotification } from "@/lib/notifications";
 const Schema = z.object({
   score: z.number().int().min(1).max(5),
   reviewText: z.string().max(2000).optional(),
+  photoKey: z.string().max(500).optional(),
 });
 
 type Params = { params: Promise<{ id: string }> };
@@ -34,7 +35,12 @@ export async function POST(req: NextRequest, { params }: Params) {
 
   if (existing) {
     await db.update(ratings)
-      .set({ score: parsed.data.score, reviewText: parsed.data.reviewText, updatedAt: new Date() })
+      .set({
+        score: parsed.data.score,
+        reviewText: parsed.data.reviewText,
+        photoKey: parsed.data.photoKey,
+        updatedAt: new Date(),
+      })
       .where(eq(ratings.id, existing.id));
     return NextResponse.json({ updated: true });
   }
@@ -45,6 +51,7 @@ export async function POST(req: NextRequest, { params }: Params) {
     userId: session!.user.id,
     score: parsed.data.score,
     reviewText: parsed.data.reviewText,
+    photoKey: parsed.data.photoKey,
   });
   void createNotification({ userId: recipe.authorId, type: "rating", actorId: session!.user.id, recipeId: id });
   return NextResponse.json({ created: true }, { status: 201 });