feat: add "cooked it" photo reviews

Users can rate a recipe with review text and an optional photo. Adds
ratings.photo_key column, a reviews list endpoint, and a review-purpose
presign path (reviewer isn't the recipe owner, so the upload
authorization differs from cover-photo uploads).

Also fixes CSP connect-src/img-src to allow the storage origin —
direct-to-S3/MinIO presigned uploads and stored images were silently
blocked by Content-Security-Policy in the browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/schema/social.ts

@@ -26,10 +26,12 @@ export const ratings = pgTable("ratings", {
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   score: integer("score").notNull(),
   reviewText: text("review_text"),
+  photoKey: text("photo_key"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
 }, (t) => [
   index("ratings_user_idx").on(t.userId),
+  index("ratings_recipe_idx").on(t.recipeId),
 ]);
 
 export const favorites = pgTable("favorites", {