feat: add "cooked it" photo reviews

Users can rate a recipe with review text and an optional photo. Adds
ratings.photo_key column, a reviews list endpoint, and a review-purpose
presign path (reviewer isn't the recipe owner, so the upload
authorization differs from cover-photo uploads).

Also fixes CSP connect-src/img-src to allow the storage origin —
direct-to-S3/MinIO presigned uploads and stored images were silently
blocked by Content-Security-Policy in the browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/messages/fr.json

@@ -732,6 +732,14 @@
     "replyButton": "Répondre",
     "reportButton": "Signaler",
     "ratingFailed": "Échec de la notation",
+    "cookedItPrompt": "Vous l'avez cuisiné ? Notez-la et partagez une photo",
+    "reviewTextPlaceholder": "Comment était le résultat ?",
+    "reviewPhotoAdd": "Ajouter une photo",
+    "reviewPhotoUploading": "Envoi…",
+    "reviewPhotoFailed": "Échec de l'envoi de la photo",
+    "reviewSubmit": "Publier l'avis",
+    "reviewSubmitting": "Publication…",
+    "reviewsTitle": "{count, plural, one {# avis} other {# avis}}",
     "justNow": "à l'instant",
     "minutesAgo": "il y a {mins} min",
     "hoursAgo": "il y a {hours} h",