Add Cloudinary for fast, safe product images

You are a senior full-stack developer working inside my Next.js (App Router), TypeScript, Tailwind and Drizzle project for "Thread & Needle", a fashion e-commerce store selling women's and men's clothing, shoes and accessories. I am not a programmer, so explain technical words briefly.

Goal: store and deliver product images with Cloudinary, replacing the placeholder images from Episode 8. Read Cloudinary's current official documentation for exact function names and upload options before coding, and tell me which pages you used.

Plan first: show me your plan, including the Cloudinary folder layout, the database change and the image sizes, and wait for my OK before changing anything.

Keys: you need the cloud name, the API key and the API secret. Do not ask me to type them in this chat. Tell me the exact names to add to .env.local, let me paste the values there myself, and add only the names to the committed .env.example. You may check that each name is set, but never print, log or commit a value. Only the cloud name may reach browser code.

Tasks, after I approve:
1. Create a branch named feature/cloudinary.
2. Add the Cloudinary server library and a server-only module that reads the environment values and fails clearly if one is missing.
3. Database: make sure each image record stores the Cloudinary public id (not a full URL), alt text (required, not empty), width, height, sort order and which product it belongs to. Create the change as a drizzle-kit migration.
4. Delivery: build one helper that turns a public id and a width into an optimized URL using automatic format and automatic quality, and wire it into next/image or the Cloudinary-recommended approach for Next.js. Allow only my own Cloudinary cloud in the image settings, not every Cloudinary address. Use sensible sizes for listing cards, galleries and the cart, lazy loading below the fold, and priority only for the main product image.
5. Signed upload: create a server route that returns a signature for an upload, restricted to a fixed folder for Thread & Needle products, allowed formats JPG, PNG and WebP only (no SVG), and a short-lived timestamp. Until accounts arrive in Episode 11, this route must deny every request with a 403 and a code comment saying that the admin check is added in Episode 11. After upload, the save step must confirm the result belongs to my folder and has an allowed format before writing to the database, and must refuse files over 5 MB.
6. Seed images: write a one-off script that uploads my photos (or generated sample images) to Cloudinary using the server keys, saves the public ids and alt text for the seeded products, and can be re-run safely without duplicating images.
7. Replace the placeholders on the shop and product pages. Each image needs meaningful alt text that describes the product, such as the item, color and view, and decorative images get an empty alt.

Rules:
- Secrets stay in .env.local only. If one ever appears in a file, log or git history, stop and tell me so I can rotate it.
- Never accept an upload URL or file path from a visitor, and never expose upload or delete to the public.

Verify by running yourself and showing results: type check, lint, production build, a test that the signing route returns 403 today, a test of the URL helper, and a check that product pages load images from my cloud with f_auto and q_auto.

Commit in small steps, push and open a pull request.

Report back in this format:
1. What you did.
2. What I should check myself.
3. Anything that needs my decision.

Review the prompt, then copy it. Never paste real passwords or API keys into a chat.