fix: applicant portal — document uploads, round filtering, auth hardening

Fix round-specific document uploads (submittedAt no longer blocks uploads),
add view/download buttons for existing files, enforce active-round-only for
uploads/deletes. Harden auth layout and set-password page. Filter applicant
portal rounds by award track membership.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/app/(auth)/set-password/page.tsx

@@ -36,17 +36,9 @@ export default function SetPasswordPage() {
       setIsSuccess(true)
       // Update the session to reflect the password has been set
       await updateSession()
-      // Redirect after a short delay
+      // Redirect after a short delay — all roles go to onboarding first
       setTimeout(() => {
-        if (session?.user?.role === 'JURY_MEMBER') {
-          router.push('/jury')
-        } else if (session?.user?.role === 'SUPER_ADMIN' || session?.user?.role === 'PROGRAM_ADMIN') {
-          router.push('/admin')
-        } else if (session?.user?.role === 'APPLICANT') {
-          router.push('/onboarding')
-        } else {
-          router.push('/')
-        }
+        router.push('/onboarding')
       }, 2000)
     },
     onError: (err) => {