fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/comments/[id]/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { db, comments, eq, and } from "@epicure/db";
+import { db, comments, users, eq } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 
 type Params = { params: Promise<{ id: string }> };
@@ -30,8 +30,17 @@ export async function DELETE(_req: NextRequest, { params }: Params) {
 
   const comment = await db.query.comments.findFirst({ where: eq(comments.id, id) });
   if (!comment) return NextResponse.json({ error: "Not found" }, { status: 404 });
-  if (comment.userId !== session!.user.id && session!.user.role === "user") {
-    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  if (comment.userId !== session!.user.id) {
+    // session.user.role comes from a 5-minute cookieCache — a just-demoted
+    // moderator/admin would keep access for up to 5 minutes. Re-query fresh.
+    const [dbUser] = await db
+      .select({ role: users.role })
+      .from(users)
+      .where(eq(users.id, session!.user.id))
+      .limit(1);
+    if (dbUser?.role !== "admin" && dbUser?.role !== "moderator") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
   }
 
   await db.delete(comments).where(eq(comments.id, id));