B2.2: Reviews, photos, owner responses, favorites, and claims

Part of #1.

• BusinessReview CRUD with rating distribution stats per business (mirror the commerce reviews fetchStats shape), helpful/unhelpful votes, verified-purchase badge when linked to an order
• Review photos (BusinessPhoto relation), owner response (one per review, merchant-gated)
• Favorites (save/unsave, list), review composer entry route for the receipt QR deep link
• Claim funnel: claim request on a listed business -> admin approval -> business linked to a Team (no outbound email to real businesses - demo guard)
• Feature tests across the moderation/ownership gates

Verified in production after the deploy.

• Review posted through the browser at nonna-pia; the distribution updated to 4.7 from 3 and the card marked itself "Your review"
• Composer correctly absent on gjelina, with the reason shown instead of a missing button
• Claim submitted from the place page and appearing in the queue at /claims
• Save round-tripped from a place page to /saved

Two stx traps found on the way, both worth filing upstream: renders empty in the dev server but correctly in stx build output, and the client router follows a link click whatever preventDefault does, so the claim trigger navigated instead of opening its form. The markup keeps the anchor for readers without JavaScript and the script swaps it for a button.