feat: review delete/update AP propagation, remote actor avatars, OpenAPI updates

- Send Delete activity when a review is deleted
- Send Update(Note) activity when a review is edited
- Remote actor avatars shown in followers/following pages
- OpenAPI spec updated with profile, blocked domains, blocked actor endpoints
- Fix: worker wire() call missing allow_registration argument

crates/application/src/ports.rs

@@ -9,6 +9,7 @@ pub struct RemoteActorView {
     pub handle: String,
     pub display_name: Option<String>,
     pub url: String,
+    pub avatar_url: Option<String>,
 }
 
 pub struct HtmlPageContext {

crates/application/src/use_cases/delete_review.rs

@@ -22,6 +22,17 @@ pub async fn execute(ctx: &AppContext, cmd: DeleteReviewCommand) -> Result<(), D
     let movie_id = review.movie_id().clone();
     ctx.review_repository.delete_review(&review_id).await?;
 
+    if let Err(e) = ctx
+        .event_publisher
+        .publish(&DomainEvent::ReviewDeleted {
+            review_id: review_id.clone(),
+            user_id: requesting_user_id.clone(),
+        })
+        .await
+    {
+        tracing::warn!("failed to publish ReviewDeleted: {e}");
+    }
+
     let history = ctx.diary_repository.get_review_history(&movie_id).await?;
     if history.viewings().is_empty() {
         let poster_path = history.movie().poster_path().cloned();

crates/application/src/worker.rs

@@ -93,6 +93,7 @@ mod tests {
                 DomainEvent::MovieDiscovered { .. } => "movie_discovered",
                 DomainEvent::ReviewLogged { .. } => "review_logged",
                 DomainEvent::ReviewUpdated { .. } => "review_updated",
+                DomainEvent::ReviewDeleted { .. } => "review_deleted",
                 DomainEvent::MovieDeleted { .. } => "movie_deleted",
                 DomainEvent::UserUpdated { .. } => "user_updated",
             };