fix: strictly anonymize client names in reviews (only first name, first word)

backend/routers/orders.py

@@ -203,8 +203,8 @@ async def approve_order_review(order_id: int, admin: dict = Depends(require_admi
 
 @router.get("/reviews/public")
 async def get_public_reviews():
-    # Only return approved reviews, anonymized (only first name)
-    query = "SELECT first_name, rating, review_text FROM orders WHERE review_approved = TRUE ORDER BY created_at DESC LIMIT 10"
+    # Only return approved reviews, anonymized (strictly only the first word of the first name)
+    query = "SELECT SUBSTRING_INDEX(first_name, ' ', 1) as first_name, rating, review_text FROM orders WHERE review_approved = TRUE ORDER BY created_at DESC LIMIT 10"
     return db.execute_query(query)
 
 @router.post("/estimate")