Three things stood between the desk and an attached receipt:

- The picker on the create form listed extensions (.jpg,.png,…), which on
  iOS greys out the camera roll; and both components validated
  mimes:jpg,jpeg,png,pdf,webp, so a HEIC photo — the iPhone default —
  was refused after the picker had accepted it. Both now accept image/*
  plus heic/heif, and validate the same set.
- The attachment stream built Content-Disposition by hand with
  addslashes(). Receipt names here are Arabic, and an Arabic filename is
  not a legal header value: the inline preview came back broken and the
  download came back mangled. Symfony builds the header now, via
  Storage::response() for inline and download() for the save.
- HEIC is an image no browser but Safari paints, so it falls back to the
  file card instead of a broken <img> (attachmentIsViewableImage()).

Also: the create form advertised a 5MB ceiling while the real one is
config('uploads.max_kb') (150MB), and its uploaded-file chip called
getClientOriginalName() on whatever sat in the property.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>