fix: security hardening — block self-registration, SSE auth, audit logging fixes

Security fixes:
- Block self-registration via magic link (PrismaAdapter createUser throws)
- Magic links only sent to existing ACTIVE users (prevents enumeration)
- signIn callback rejects non-existent users (defense-in-depth)
- Change schema default role from JURY_MEMBER to APPLICANT
- Add authentication to live-voting SSE stream endpoint
- Fix false FILE_OPENED/FILE_DOWNLOADED audit events on page load
  (remove purpose from eagerly pre-fetched URL queries)

Bug fixes:
- Fix impersonation skeleton screen on applicant dashboard
- Fix onboarding redirect loop in auth layout

Observer dashboard redesign (Steps 1-6):
- Clickable round pipeline with selected round highlighting
- Round-type-specific dashboard panels (intake, filtering, evaluation,
  submission, mentoring, live final, deliberation)
- Enhanced activity feed with server-side humanization
- Previous round comparison section
- New backend queries for round-specific analytics

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/components/shared/requirement-upload-slot.tsx

@@ -72,7 +72,7 @@ interface RequirementUploadSlotProps {
 
 function ViewFileButton({ bucket, objectKey }: { bucket: string; objectKey: string }) {
   const { data } = trpc.file.getDownloadUrl.useQuery(
-    { bucket, objectKey, forDownload: false, purpose: 'open' as const },
+    { bucket, objectKey, forDownload: false },
     { staleTime: 10 * 60 * 1000 }
   )
   const href = typeof data === 'string' ? data : data?.url
@@ -87,7 +87,7 @@ function ViewFileButton({ bucket, objectKey }: { bucket: string; objectKey: stri
 
 function DownloadFileButton({ bucket, objectKey, fileName }: { bucket: string; objectKey: string; fileName: string }) {
   const { data } = trpc.file.getDownloadUrl.useQuery(
-    { bucket, objectKey, forDownload: true, fileName, purpose: 'download' as const },
+    { bucket, objectKey, forDownload: true, fileName },
     { staleTime: 10 * 60 * 1000 }
   )
   const href = typeof data === 'string' ? data : data?.url