fix: photos lost on save, multi-upload only kept last file, thumbnails 400

recipe-form/API routes were never sending/persisting photos on create+update.
PhotoUploader accumulated uploads via a stale closure over the photos prop, so
only the last file of a multi-select survived. Once both were fixed, thumbnails
still 400'd because Next's image optimizer blocks upstream hosts resolving to
private/loopback IPs (localhost:9000 MinIO) — skip optimization for
storage-hosted photos since they're already web-sized user uploads.

apps/web/app/api/v1/recipes/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { db, recipes, recipeIngredients, recipeSteps } from "@epicure/db";
+import { db, recipes, recipeIngredients, recipeSteps, recipePhotos } from "@epicure/db";
 import { eq, desc, and } from "@epicure/db";
 import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
@@ -43,6 +43,10 @@ const CreateRecipeSchema = z.object({
     timerSeconds: z.number().int().min(0).max(86400).optional(),
     order: z.number().int().optional(),
   })).max(100).default([]),
+  photos: z.array(z.object({
+    key: z.string().min(1).max(500),
+    isCover: z.boolean().default(false),
+  })).max(20).default([]),
 });
 
 export async function GET(req: NextRequest) {
@@ -135,6 +139,18 @@ export async function POST(req: NextRequest) {
         }))
       );
     }
+
+    if (data.photos.length > 0) {
+      await tx.insert(recipePhotos).values(
+        data.photos.map((photo, i) => ({
+          id: crypto.randomUUID(),
+          recipeId: id,
+          storageKey: photo.key,
+          order: i,
+          isCover: photo.isCover,
+        }))
+      );
+    }
   });
 
   const recipe = await db.query.recipes.findFirst({ where: eq(recipes.id, id) });