feat: add "cooked it" photo reviews

Users can rate a recipe with review text and an optional photo. Adds
ratings.photo_key column, a reviews list endpoint, and a review-purpose
presign path (reviewer isn't the recipe owner, so the upload
authorization differs from cover-photo uploads).

Also fixes CSP connect-src/img-src to allow the storage origin —
direct-to-S3/MinIO presigned uploads and stored images were silently
blocked by Content-Security-Policy in the browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/migrations/0021_mysterious_madame_masque.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "ratings" ADD COLUMN "photo_key" text;--> statement-breakpoint
+CREATE INDEX "ratings_recipe_idx" ON "ratings" USING btree ("recipe_id");

packages/db/src/migrations/meta/_journal.json

@@ -148,6 +148,13 @@
       "when": 1783109825851,
       "tag": "0020_acoustic_exiles",
       "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "7",
+      "when": 1783602591480,
+      "tag": "0021_mysterious_madame_masque",
+      "breakpoints": true
     }
   ]
 }