fix(api): verify profile ownership before review creation

[Kienda]

Summary

Prevents authenticated users from creating reviews for profiles they do not own. The review service now verifies that the requested profile belongs to the current user before creating a review, and the API returns 404 without scheduling background processing when ownership cannot be verified.

Issue

Closes #163

Changes

• Added an ownership-scoped Profile lookup to create_review()
• Return None without writing when the profile is missing or belongs to another user
• Return 404 Profile not found from POST /reviews for rejected profiles
• Prevent background review processing from being scheduled after rejection
• Added service-level cross-user regression coverage
• Added route-level coverage for the 404 response and absent background task
• Added the Week 9 progress check-in to JOURNAL.md

Testing

• New/updated tests cover the changes
• Focused unit tests pass
• Integration tests pass
• Full linter passes
• Full type checker passes

Focused command:

.\.venv\Scripts\pytest.exe tests/unit/test_review_service.py tests/unit/test_review_routes.py -q -k create_review

Result: 7 passed, 14 deselected.

The full repository unit command currently reports 52 failures and 31 setup errors in unrelated modules. Existing examples include bias detection, parsers, chunker fixtures, skill extraction, and pre-existing review-service mock problems. The new review-creation tests pass.

GNU Make is not installed in the local PowerShell environment, so I ran the underlying pytest, Ruff, Black, and mypy commands directly. The new route test passes Ruff and Black checks. Repository-wide linting and typing still report pre-existing issues.

Screenshots / Demo

Not applicable; this is an API authorization fix.

Notes for Reviewers

Please review whether returning 404 for both nonexistent and differently owned profiles is the preferred behavior. This matches the existing profile endpoints and avoids exposing whether another user’s profile exists.