Add special orders API and related media/auth updates.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/schema.prisma

@@ -49,6 +49,7 @@ model User {
   refreshTokens    RefreshToken[]
   addresses        UserAddress[]
   orders           Order[]
+  specialOrders    SpecialOrder[]
   discounts        Discount[]        @relation("DiscountAssignee")
   discountsCreated Discount[]        @relation("DiscountCreatedBy")
 
@@ -304,3 +305,36 @@ model Discount {
   @@index([categoryId])
   @@index([active, expiresAt])
 }
+
+enum SpecialOrderCategory {
+  specialCake
+  specialPastry
+}
+
+/// Custom request form (no payment / product link) — shown to admins.
+model SpecialOrder {
+  id          String                @id @default(cuid())
+  userId      String
+  user        User                  @relation(fields: [userId], references: [id], onDelete: Cascade)
+  category    SpecialOrderCategory
+  name        String
+  description String                @default("")
+  createdAt   DateTime              @default(now())
+  updatedAt   DateTime              @updatedAt
+  images      SpecialOrderImage[]
+
+  @@index([userId])
+  @@index([category])
+  @@index([createdAt])
+}
+
+model SpecialOrderImage {
+  id             String       @id @default(cuid())
+  specialOrderId String
+  specialOrder   SpecialOrder @relation(fields: [specialOrderId], references: [id], onDelete: Cascade)
+  url            String
+  storageKey     String
+  sortOrder      Int          @default(0)
+
+  @@index([specialOrderId])
+}