admin: inline filing screenshots + atomic approve transaction

- Documents now flag is_image and the drawer renders screenshots / confirmation
  images as inline clickable thumbnails (click to open full size); PDFs keep the
  View link. Evidence keys are labeled (Filing confirmation screenshot, etc.),
  the worker-temp screenshot_path (not a MinIO key) is dropped in favor of the
  durable evidence copy, and non-file evidence (fax_log_id) is skipped.
- Wrap approve's status-update + audit-insert in a transaction so a failure can
  no longer leave an order out of ready_to_file without dispatching (the earlier
  audit CHECK violation did exactly that to Paul's UCR; it has been reset).

site/public/admin/compliance-orders/index.html

@@ -401,6 +401,20 @@
         box.innerHTML = documents.map((d) => {
           const u = API + "/api/v1/admin/compliance-orders/" + encodeURIComponent(orderNumber)
             + "/document?key=" + encodeURIComponent(d.key) + "&token=" + tok;
+          // Render screenshots/images as an inline clickable thumbnail so you can
+          // see the filing confirmation at a glance; PDFs stay as a View link.
+          if (d.is_image) {
+            return `<div style="padding:8px 0;border-top:1px solid var(--gray100);">
+                <div class="svc-left" style="margin-bottom:6px;">
+                  <span style="font-size:13px;">${esc(d.label)}</span>
+                  <span class="small">${esc(d.key.split("/").pop())}</span>
+                </div>
+                <a href="${u}" target="_blank" rel="noopener" title="Open full size">
+                  <img src="${u}" alt="${esc(d.label)}" loading="lazy"
+                    style="max-width:100%;border:1px solid var(--gray200);border-radius:6px;display:block;" />
+                </a>
+              </div>`;
+          }
           return `<div class="svc-row"><div class="svc-left">
               <span style="font-size:13px;">${esc(d.label)}</span>
               <span class="small">${esc(d.key.split("/").pop())}</span>