_serialize_review() was not returning the reviewer's profile_picture URL,
so the consumer app had no field to key off and always rendered DiceBear
cartoons for every reviewer.
- Resolves r.reviewer.profile_picture.url when non-empty
- Treats default.png placeholder as no-photo (returns empty string)
- Defensive try/except around FK dereference, same pattern as user.py
Paired with mvnew consumer v1.7.8 which consumes the new field.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sicherhaven
d9a2af7168