fix: journey stage-instances + standards attachments API 500s

Bug #42 (journeys): PatientJourneyStageInstanceViewSet.get_queryset()
called select_related('physician', 'survey_instance') but neither field
exists on the model. Changed 'physician' -> 'staff' (the actual FK)
and removed 'survey_instance' (no such relation). Endpoint now returns 200.

Bug #43 (standards): StandardAttachmentViewSet.get_queryset() filtered on
'departments__hospital' but StandardAttachment has no 'departments' field.
Fixed to traverse compliance__department__hospital. Also fixed invalid
ordering field 'uploaded_at' -> 'created_at'. Endpoint now returns 200.

API endpoint sweep: 73 DRF endpoints across all 21 apps tested, 0 errors.
Full URL sweep: 427 URL patterns tested, 0 server errors.

apps/journeys/views.py

@@ -225,9 +225,8 @@ class PatientJourneyStageInstanceViewSet(viewsets.ReadOnlyModelViewSet):
         queryset = super().get_queryset().select_related(
             'journey_instance',
             'stage_template',
-            'physician',
+            'staff',
             'department',
-            'survey_instance'
         )
 
         user = self.request.user

apps/standards/views.py

@@ -113,7 +113,7 @@ class StandardAttachmentViewSet(viewsets.ModelViewSet):
     queryset = StandardAttachment.objects.all()
     filterset_fields = ["compliance"]
     search_fields = ["filename", "description"]
-    ordering = ["-uploaded_at"]
+    ordering = ["-created_at"]
 
     def get_serializer_class(self):
         from apps.standards.serializers import StandardAttachmentSerializer
@@ -126,7 +126,7 @@ class StandardAttachmentViewSet(viewsets.ModelViewSet):
         if user.is_px_admin():
             return queryset
         if user.hospital:
-            return queryset.filter(departments__hospital=user.hospital)
+            return queryset.filter(compliance__department__hospital=user.hospital)
         return queryset.none()