fix(reviews): expose profile_photo in /api/reviews/list payload

_serialize_review() was not returning the reviewer's profile_picture URL,
so the consumer app had no field to key off and always rendered DiceBear
cartoons for every reviewer.

- Resolves r.reviewer.profile_picture.url when non-empty
- Treats default.png placeholder as no-photo (returns empty string)
- Defensive try/except around FK dereference, same pattern as user.py

Paired with mvnew consumer v1.7.8 which consumes the new field.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

mobile_api/views/reviews.py

@@ -29,11 +29,20 @@ def _serialize_review(r, user_interactions=None):
         uname = r.reviewer.username
     except Exception:
         uname = ''
+    try:
+        pic = r.reviewer.profile_picture
+        if pic and pic.name and 'default.png' not in pic.name:
+            profile_photo = pic.url
+        else:
+            profile_photo = ''
+    except Exception:
+        profile_photo = ''
     return {
         'id': r.id,
         'event_id': r.event_id,
         'username': uname,
         'display_name': display,
+        'profile_photo': profile_photo,
         'rating': r.rating,
         'comment': r.review_text,
         'status': _STATUS_TO_JSON.get(r.status, r.status),