Write a review or reply on a published component

The token is checked first, then the body. With parent the request creates a reply: parent must be a top-level review of the same component, the text is required and the rating is ignored (stored as 0).

Without parent it writes the caller's top-level review: rating 1–5 is required, the text is optional, and each user has at most one top-level review per component (a second POST updates its rating and text).

The author name is derived from the token's user (name, else the local part of the e-mail address). On success the component's review_count, review_avg and review_dist are recomputed and the fresh thread is returned.