feat: add "cooked it" photo reviews

Users can rate a recipe with review text and an optional photo. Adds
ratings.photo_key column, a reviews list endpoint, and a review-purpose
presign path (reviewer isn't the recipe owner, so the upload
authorization differs from cover-photo uploads).

Also fixes CSP connect-src/img-src to allow the storage origin —
direct-to-S3/MinIO presigned uploads and stored images were silently
blocked by Content-Security-Policy in the browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/recipes/[id]/rate/route.ts

@@ -7,6 +7,7 @@ import { createNotification } from "@/lib/notifications";
 const Schema = z.object({
   score: z.number().int().min(1).max(5),
   reviewText: z.string().max(2000).optional(),
+  photoKey: z.string().max(500).optional(),
 });
 
 type Params = { params: Promise<{ id: string }> };
@@ -34,7 +35,12 @@ export async function POST(req: NextRequest, { params }: Params) {
 
   if (existing) {
     await db.update(ratings)
-      .set({ score: parsed.data.score, reviewText: parsed.data.reviewText, updatedAt: new Date() })
+      .set({
+        score: parsed.data.score,
+        reviewText: parsed.data.reviewText,
+        photoKey: parsed.data.photoKey,
+        updatedAt: new Date(),
+      })
       .where(eq(ratings.id, existing.id));
     return NextResponse.json({ updated: true });
   }
@@ -45,6 +51,7 @@ export async function POST(req: NextRequest, { params }: Params) {
     userId: session!.user.id,
     score: parsed.data.score,
     reviewText: parsed.data.reviewText,
+    photoKey: parsed.data.photoKey,
   });
   void createNotification({ userId: recipe.authorId, type: "rating", actorId: session!.user.id, recipeId: id });
   return NextResponse.json({ created: true }, { status: 201 });

apps/web/app/api/v1/recipes/[id]/reviews/route.ts

@@ -0,0 +1,42 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, recipes, ratings, eq, and, or, inArray, desc } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function GET(_req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { id } = await params;
+
+  const recipe = await db.query.recipes.findFirst({
+    where: and(
+      eq(recipes.id, id),
+      or(eq(recipes.authorId, session!.user.id), inArray(recipes.visibility, ["public", "unlisted"]))
+    ),
+    columns: { id: true },
+  });
+  if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const rows = await db.query.ratings.findMany({
+    where: eq(ratings.recipeId, id),
+    orderBy: desc(ratings.createdAt),
+    limit: 50,
+    with: {
+      user: { columns: { id: true, name: true, username: true, avatarUrl: true } },
+    },
+  });
+
+  const reviews = rows
+    .filter((r) => r.reviewText || r.photoKey)
+    .map((r) => ({
+      id: r.id,
+      score: r.score,
+      reviewText: r.reviewText,
+      photoKey: r.photoKey,
+      createdAt: r.createdAt,
+      user: r.user,
+    }));
+
+  return NextResponse.json({ data: reviews });
+}