Put images behind the session and make routes private by default

The /minio-images rewrite proxied straight onto the MinIO bucket with no
authentication, and the bucket carries an anonymous read policy. Verified
from the public internet: GET /minio-images?list-type=2 returned a full
ListBucketResult naming all 33 objects, and any key then fetched 200. Every
menu scan, drink photo and bar photo was enumerable and downloadable by
anyone. Replaced with a route handler that requires a session and streams
via the existing getImage(). The URL shape is unchanged, so stored
imageUrls, uploadImage/getImageUrl and every <img> keep working.

Nothing uses next/image and it must stay that way here: the optimizer
fetches server-side without the session cookie.

Route protection was an allowlist that had to be updated by hand for each
new page, and had already been missed for /bar, /bartender and /recommend,
which rendered to logged-out visitors. /recipes was in the middleware
matcher but not the authorized() list, so it fell through too. Inverted
both to a denylist so new pages are private by default. /api stays out of
the matcher because authorized() answers with an HTML redirect and API
clients need the JSON 401 those routes already return.

Also fixes a cross-user write: POST /api/recipes took sourceDrinkId from
the client with no ownership check, and the drink detail page loaded its
recipes relation unfiltered, so one user could attach an arbitrary recipe
to another user's drink where it rendered permanently and the owner could
not delete it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

next.config.mjs

@@ -1,33 +1,10 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   output: "standalone",
-  images: {
-    remotePatterns: [
-      {
-        protocol: "http",
-        hostname: "localhost",
-        port: "9000",
-        pathname: "/drink-images/**",
-      },
-      {
-        protocol: "https",
-        hostname: "*.amazonaws.com",
-        pathname: "/**",
-      },
-    ],
-  },
-  async rewrites() {
-    // Proxy image requests to MinIO so URLs work from any device
-    const minioHost = process.env.MINIO_ENDPOINT || "localhost";
-    const minioPort = process.env.MINIO_PORT || "9000";
-    const minioBucket = process.env.MINIO_BUCKET || "drink-images";
-    return [
-      {
-        source: "/minio-images/:path*",
-        destination: `http://${minioHost}:${minioPort}/${minioBucket}/:path*`,
-      },
-    ];
-  },
+  // No `images.remotePatterns` and no rewrite to MinIO: images are served by the
+  // session-gated route at src/app/minio-images/[...key]/route.ts. The rewrite this
+  // replaced was an unauthenticated proxy onto the bucket. Nothing uses next/image,
+  // and it must stay that way - the optimizer fetches without the session cookie.
   async headers() {
     return [
       {
@@ -69,13 +46,11 @@ const nextConfig = {
               // only ever receive as a URL at sign-in.
               [
                 "img-src 'self' data: blob:",
-                "http://localhost:9000",
-                "https://*.amazonaws.com",
                 "https://lh3.googleusercontent.com",
                 "https://avatars.githubusercontent.com",
               ].join(" "),
               "font-src 'self'",
-              "connect-src 'self' http://localhost:9000",
+              "connect-src 'self'",
               "frame-ancestors 'none'",
               "base-uri 'self'",
               "form-action 'self'",