broken behaviour with non image files in pre authorisation screenshot field

### Describe your goals

review the following report
https://hcb.hackclub.com/grants/YeIpVN/pre_authorizations

### Describe the bug

user uploaded a PDF copy of the reciept, an image format was expected but non image formats weren't blocked.
On the pre auth page both the uploader and myself (the reviewer) were unable to see the uploaded PDF file.
either non image formats should be blocked or PDFs should be rendered/downloadable/supported.

Start by reproducing the linked pre-authorisation report with a PDF receipt and trace the screenshot upload and display path on the pre-auth page. Done means either non-image uploads are clearly rejected or PDFs are supported for both the uploader and reviewer, with the chosen behavior covered by a test.

Written by the indexing model from the issue text.