fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/recipes/route.ts

@@ -3,6 +3,7 @@ import { db, recipes, recipeIngredients, recipeSteps, recipePhotos, recipeBatchD
 import { eq, desc, and } from "@epicure/db";
 import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
+import { isOwnedRecipePhotoKey } from "@/lib/storage";
 import { checkAndIncrementTierLimit, TierLimitError } from "@/lib/tiers";
 import { dispatchWebhook } from "@/lib/webhooks";
 import { parseQuantity } from "@/lib/parse-quantity";
@@ -93,6 +94,14 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
   }
 
+  const id = crypto.randomUUID();
+  const now = new Date();
+  const data = parsed.data;
+
+  if (data.photos.some((p) => !isOwnedRecipePhotoKey(p.key, id, session!.user.id))) {
+    return NextResponse.json({ error: "Validation error", issues: [{ path: ["photos"], message: "Photo key not issued for this recipe" }] }, { status: 400 });
+  }
+
   try {
     await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "recipe");
   } catch (err) {
@@ -102,10 +111,6 @@ export async function POST(req: NextRequest) {
     throw err;
   }
 
-  const id = crypto.randomUUID();
-  const now = new Date();
-  const data = parsed.data;
-
   await db.transaction(async (tx) => {
     await tx.insert(recipes).values({
       id,