Feat: EAP UAT Feedbacks batch II

[susilnem]

Changes

• AttributeError: 'dict' object has no attribute 'lists'
• TypeError: str returned non-string (type NoneType)## Addresses
• Add PotentialRisk model and potential_risks/early_actions M2M fields on
  SimplifiedEAP, required for submission
• Add Admin1 model (district + per-selection description) and districts
  field on CommonEAPFields, as an Admin2 fallback for countries without
  admin2 data
• Add appeal_code to EAPRegistration, fillable only via admin (read-only
  via API)
• Add final_review_checklist_file to EAPRegistration; require it on the
  UNDER_REVIEW -> TECHNICALLY_VALIDATED transition, clear it alongside
  validated_budget_file/technically_validated_at on revert to
  NS_ADDRESSING_COMMENTS
• Make SourceInformation.source_link optional for offline-only sources
• Add missing max_length on SecureFileField usages to prevent
  SuspiciousFileOperation on long filenames
• Extend file extension validation to cover images across FILE_FIELDS
• Change FullEAP.lead_time from CharField to IntegerField (migration
  uses remove+add instead of alter, to avoid a cast failure on existing
  non-numeric data)
• Update admin/viewset querysets with select_related/prefetch_related
  for the new relations

Checklist

Things that should succeed before merging.

• Updated/ran unit tests
• Updated CHANGELOG.md

Release

If there is a version update, make sure to tag the repository with the latest version.