feat: add "cooked it" photo reviews

Users can rate a recipe with review text and an optional photo. Adds
ratings.photo_key column, a reviews list endpoint, and a review-purpose
presign path (reviewer isn't the recipe owner, so the upload
authorization differs from cover-photo uploads).

Also fixes CSP connect-src/img-src to allow the storage origin —
direct-to-S3/MinIO presigned uploads and stored images were silently
blocked by Content-Security-Policy in the browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/messages/en.json

@@ -744,6 +744,14 @@
     "replyButton": "Reply",
     "reportButton": "Report",
     "ratingFailed": "Failed to rate",
+    "cookedItPrompt": "Cooked it? Rate it and share a photo",
+    "reviewTextPlaceholder": "How did it turn out?",
+    "reviewPhotoAdd": "Add photo",
+    "reviewPhotoUploading": "Uploading…",
+    "reviewPhotoFailed": "Failed to upload photo",
+    "reviewSubmit": "Post review",
+    "reviewSubmitting": "Posting…",
+    "reviewsTitle": "{count, plural, one {# review} other {# reviews}}",
     "justNow": "just now",
     "minutesAgo": "{mins}m ago",
     "hoursAgo": "{hours}h ago",