Fix broken joinedload and import path in reviews/activities endpoints

joinedload("reviewer") used a string instead of a class-bound
attribute (rejected by SQLAlchemy 2.x), and models.submission was the
wrong import path for Submission. Both endpoints 500'd whenever
actually called; surfaced while wiring real dashboard/activity data
into the frontend.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/routers/reviews.py

@@ -66,7 +66,7 @@ async def get_pending_reviews(
     query = db.query(Submission).options(
         joinedload(Submission.user),
         joinedload(Submission.task).joinedload(Task.project),
-        joinedload(Submission.reviews).joinedload("reviewer")
+        joinedload(Submission.reviews).joinedload(Review.reviewer)
     ).join(Task).filter(
         Submission.deleted_at.is_(None),
         Task.deleted_at.is_(None)