feat(#623): add course rating and review system API

[jerrymusaga]

Summary

Closes #623

• Migration (013_course_reviews.sql): adds course_reviews table with course_id (FK → courses.id), learner_address, rating (1–5 CHECK), review_text (nullable), created_at, and a UNIQUE(course_id, learner_address) constraint to prevent duplicate reviews. Includes rollback file.
• GET /api/courses/:idOrSlug/reviews (public): returns paginated reviews plus aggregate avgRating and total for any published course.
• POST /api/courses/:idOrSlug/reviews (auth required): validates enrollment, enforces 1–5 rating, sanitizes review text (plain text only, max 2000 chars), and returns 409 on duplicate via the DB unique constraint.
• GET /api/courses and GET /api/courses/:idOrSlug: now include avgRating (rounded to 1 decimal, null if no reviews) and reviewCount fields via a LEFT JOIN course_reviews.

Test plan

• Run npm run migrate in server/ to apply 013_course_reviews.sql
• GET /api/courses — confirm avgRating and reviewCount fields appear on each course object
• GET /api/courses/:slug/reviews with no reviews — expect { data: [], total: 0, avgRating: null }
• POST /api/courses/:slug/reviews without Bearer token — expect 401
• POST /api/courses/:slug/reviews with a valid token but not enrolled — expect 403
• POST /api/courses/:slug/reviews with a valid enrolled token and { "rating": 4, "reviewText": "Great course!" } — expect 201
• Repeat the POST — expect 409 "You have already reviewed this course"
• GET /api/courses/:slug/reviews after submission — confirm review appears and avgRating is correct
• POST with rating: 0 or rating: 6 — expect 400
• npm run migrate:rollback — confirm table is dropped cleanly

[drips-wave]

@jerrymusaga Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits