fix: applicant portal — document uploads, round filtering, auth hardening

Fix round-specific document uploads (submittedAt no longer blocks uploads),
add view/download buttons for existing files, enforce active-round-only for
uploads/deletes. Harden auth layout and set-password page. Filter applicant
portal rounds by award track membership.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/lib/storage/index.ts

@@ -126,6 +126,14 @@ export function getContentType(fileName: string): string {
  * Validate image file type
  */
 export function isValidImageType(contentType: string): boolean {
-  const validTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']
+  const validTypes = [
+    'image/jpeg',
+    'image/jpg', // non-standard but common browser alias for image/jpeg
+    'image/png',
+    'image/gif',
+    'image/webp',
+    'image/svg+xml',
+    'application/octet-stream', // some browsers send this as a fallback
+  ]
   return validTypes.includes(contentType)
 }