fix: reject incompatible admin media roles

apps/api/app/routers/admin.py

@@ -17,7 +17,7 @@ from ..dependencies import Db
 from ..importer import ImportAlreadyRunning, ImportSourceError, import_records
 from rf4_research.media_assets import publish_quality_upgrades, rollback_quality_upgrade
 
-from ..media_catalog import KNOWN_MEDIA_ROLES, MEDIA_ROOT, review_assets, review_file
+from ..media_catalog import KNOWN_MEDIA_ROLES, MEDIA_ROLES_BY_ENTITY, MEDIA_ROOT, review_assets, review_file
 from ..models import CatchReport, CommunityImportRun, DataSource, ExternalObservation, Fish, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Waterbody
 from ..public_cache import public_cache
 from ..schemas import AdminCatchReportOut, AdminMediaDecision, AdminMediaReviewOut, AdminMediaRollback, AdminModerationHistoryOut, AdminSourceStatusOut, CatchReportCreated, ExternalAliasSuggestionOut, ExternalObservationAction, ExternalObservationBulkAction, ExternalObservationBulkDecision, ExternalObservationBulkMapping, ExternalObservationBulkResult, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, ImportRunOut, ModerationBulkResult, ModerationBulkUpdate, ModerationUpdate
@@ -43,6 +43,8 @@ def admin_media_catalog(
 ) -> list[AdminMediaReviewOut]:
     if media_role and media_role not in KNOWN_MEDIA_ROLES:
         raise HTTPException(status_code=422, detail="unknown media role")
+    if media_role and (not entity_type or media_role not in MEDIA_ROLES_BY_ENTITY.get(entity_type, set())):
+        raise HTTPException(status_code=422, detail="media role is incompatible with entity type")
     return review_assets(entity_type, status, media_role)[offset:offset + limit]