Make MenuItem.userId required

Backfilled from the parent scan (176/176 rows), so the column can now be
NOT NULL rather than relying on every writer remembering to set it. The
constraint was applied on the server alongside this, so the schema and
the database stay in step for the next db push.

Also rewrites two MenuScan rows that stored absolute
http://localhost:9000 URLs from before the app used the /minio-images
proxy. Those resolved against the viewer's own machine, so they have
always been broken images for anyone not running MinIO locally, and are
unreachable now that MinIO is bound to loopback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

prisma/schema.prisma

@@ -280,10 +280,10 @@ model MenuScan {
 model MenuItem {
   id             String    @id @default(cuid())
   // Denormalised from MenuScan. Ownership was only ever transitive via scanId, which
-  // worked because nothing queries MenuItem directly - but left any future direct
-  // query an IDOR with nothing to stop it. Nullable only for rows created before
-  // this column existed; every write sets it.
-  userId         String?
+  // held because nothing queries MenuItem directly - but left any future direct query
+  // an IDOR with nothing to stop it. Backfilled from the parent scan, then made
+  // required so it cannot silently go missing.
+  userId         String
   scanId         String
   name           String
   type           DrinkType