security: enforce family ownership on all baby-data API routes

All collection routes (events, growth, doctor-notes, journal, milestones,
vaccinations, milk, reminders, teeth, search, export) now verify the requested
babyId belongs to the authenticated user's family before querying or writing.
All [id] mutation routes verify record ownership via nested baby→familyId
before any PATCH/DELETE. Additional fixes: admin config masks sensitive
secrets in GET response, invite send-email enforces PARENT role, photo
serving requires authentication, baby PATCH restricted to own-family PARENT.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/reminders/[id]/route.ts

@@ -12,6 +12,11 @@ export async function PATCH(
   const { id } = await params;
   const body = await req.json();
 
+  const familyId = (session.user as { familyId?: string }).familyId;
+  if (!familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const owned = await prisma.medicationReminder.findFirst({ where: { id, baby: { familyId } } });
+  if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   const reminder = await prisma.medicationReminder.update({
     where: { id },
     data: {
@@ -35,6 +40,12 @@ export async function DELETE(
   if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
 
   const { id } = await params;
+
+  const delFamilyId = (session.user as { familyId?: string }).familyId;
+  if (!delFamilyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const delOwned = await prisma.medicationReminder.findFirst({ where: { id, baby: { familyId: delFamilyId } } });
+  if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   await prisma.medicationReminder.delete({ where: { id } });
   return new NextResponse(null, { status: 204 });
 }