fix: make screenshot retry idempotent

apps/api/tests/test_api.py

@@ -528,14 +528,21 @@ def test_admin_can_start_and_list_official_import(monkeypatch) -> None:
 
 def test_pending_report_accepts_one_validated_screenshot(monkeypatch) -> None:
     created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 91, "y": 92, "weight_g": 4200}).json()
-    monkeypatch.setattr("app.routers.submissions.upload_screenshot", lambda raw, **metadata: "reports/test.jpg" if raw == b"image-bytes" and metadata == {"filename": "catch.jpg", "content_type": "image/jpeg"} else "unexpected")
+    uploaded: list[bytes] = []
+    def fake_upload(raw, **metadata):
+        if raw == b"image-bytes" and metadata == {"filename": "catch.jpg", "content_type": "image/jpeg"}:
+            uploaded.append(raw)
+            return "reports/test.jpg"
+        return "unexpected"
+    monkeypatch.setattr("app.routers.submissions.upload_screenshot", fake_upload)
     upload_url = f"/api/v1/catch-reports/{created['id']}/screenshot"
     assert client.post(upload_url, files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")}).status_code == 401
     assert client.post(upload_url, headers={"X-Upload-Token": "wrong"}, files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")}).status_code == 401
     response = client.post(upload_url, headers={"X-Upload-Token": created["screenshot_upload_token"]}, files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")})
     assert response.status_code == 204
     reused = client.post(upload_url, headers={"X-Upload-Token": created["screenshot_upload_token"]}, files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")})
-    assert reused.status_code == 401
+    assert reused.status_code == 204
+    assert uploaded == [b"image-bytes"]
 
 
 def test_idempotency_replay_survives_completed_screenshot(monkeypatch) -> None: