- All response types now use lowercase json tags (id, name, photo_url, etc.)
- email/phone/birthdate/last_seen_at/photo_url use omitempty
- audit.Metadata type []byte (was map[string]any)
- fixes register/login inconsistency where login returned ID/Name (CamelCase)
while register returned id/name (lowercase)
- POST /api/v1/reviews (one per chat_id, UNIQUE)
- GET /api/v1/users/:id/reviews (public list)
- GET /api/v1/users/:id/stats (rating_avg, count)
- migration 0004: reviews (rating 1-5, anonymous flag), user_stats aggregate
- only chat participants can review; reviewed_id is other party
