Make the review anonymity test assert against a populated speaker list

[EllAchE]

The defect

seedReviewFixture inserted a participant row for the submission author but never linked it to
the submission through participantRole. getSubmissionDetail builds detail.speakers from that
join, so the fixture produced an empty speaker list, and this assertion in
lib/services/review.integration.test.ts:

expect(JSON.stringify(detail.speakers)).not.toContain('Vitruvius');

was running against []. It could not have failed no matter what the query returned. The test
named the strongest part of the anonymity guarantee — that a reviewer in an anonymized round never
sees the speaker roster — and verified nothing about it.

Demonstrating it

Reverting db/testing.ts to main while keeping the new assertions fails exactly where expected:

AssertionError: expected [] to have a length of 1 but got +0
 × keeps the author out of what an anonymized round hands a reviewer

The fix

Link the author's participant row to the submission as the primary speaker, assert the list is
actually populated before asserting the redaction, and cover company alongside the display name
so a leak through either field is caught.

Provenance

Recovered during a branch sweep from the abandoned pr107-fix-20260813 branch — a follow-up to
#107 that was pushed but never opened as a pull request. Every other unmerged branch in that sweep
was verified as already landed or deliberately superseded; this was the only one carrying content
that never reached main.

Verification

• bun run test:integration — 17/17 pass.
• bun run test — 1498 pass; the 12 failures are pre-existing on main in openapi/mcp files
  from the recent zod 4 and TypeScript 7 dependabot bumps, and are untouched by this change.
• bun run typecheck fails on main today in those same five unrelated files; zero errors in the
  two files this PR touches.

🤖 Generated with Claude Code

[EllAchE]

CI red here is inherited from main, not introduced by this PR. The CI run on main at ea01343 fails, and PRs #190 and #185 — also branched off current main — show the identical failure set (Lint, Typecheck, Security, Build, Contracts, Test). #173 is green only because it branched before the zod 4 / TypeScript 7 / eslint-config-next 16 dependabot merges landed.

This PR touches two files, db/testing.ts and lib/services/review.integration.test.ts. Neither appears in any failing typecheck or test output; the failures are confined to app/api/v1/_lib/openapi.ts, app/api/v1/_lib/schemas.ts, app/layout.tsx, lib/mcp/server.ts and lib/services/sponsors.ts. Locally against a clean Postgres the integration suite is 17/17 green.

Rebasing onto the dependency fix once it lands should clear this.