fix(backend): hide deleted users from listings

[luizhcastro]

Describe your changes

Account deletion is a soft delete: deleteUser sets deletedAt and rewrites the username to deleted_<uuid>, keeping the row. Every listing query still joined users without filtering deletedAt, so the anonymized handle leaked into the UI — e.g. a review signed deleted_b8ac47655ca344abaa16debbcd959200 on https://plotwist.app/en-US/movies/157336.

This turns those leftJoin(users) into innerJoin filtered by isNull(users.deletedAt), so rows owned by a deleted user are dropped from the listing:

Repository	Surface
reviews-repository.ts	reviews on media pages
review-replies-repository.ts	replies
likes-repository.ts	who-liked list
followers-repository.ts	followers / following
recommendations-repository.ts	received recommendations
list-repository.ts	public lists
user-activities.ts	activity feed (activity owner + FOLLOW_USER target)

Backend only — no API contract change, so web and iOS are both covered without client work.

How it was verified

• New regression test in get-reviews.spec.ts (testcontainers, real Postgres): fails on main, passes with the fix.
• Manual end-to-end against a local server: two users review the same movie, one deletes the account (DELETE /user) → before the fix GET /reviews returns deleted_bcd680b5b76e4baabd62f087b4a170e8, after the fix only the active user's review is listed. Same check done for GET /review-replies. Review rows stay in the database — this only hides them.

Note for reviewers: #520 lists three other approaches (generic "Deleted user" label, hard delete, mixed). This PR implements the "hide" option since it needs no client or i18n work; happy to switch if you prefer another. Not covered here: likeCount / replyCount still count interactions made by deleted users, and the nested author subqueries in buildReviewInfo / buildReplyInfo.

Issue ticket number and link

Closes #520 — #520

Checklist before requesting a review

• I have performed a self-review of my code
• If it's an essential feature, I've tested it thoroughly.
• Do we need to implement analytics? — No.
• Will this be part of a product update? If yes, please write one phrase about this update.
  • Reviews and activity from deleted accounts no longer show up as deleted_<id> across the app.

[vercel]

@luizhcastro is attempting to deploy a commit to the status-451 Team on Vercel.

A member of the Team first needs to authorize it.