fix: P1 API security hardening — rate limits, auth guards, duplicate prevention

- verify/route.ts: setDate → setUTCDate to avoid timezone off-by-one on recheck date
- triage-suggest, rca-draft, quality-check: 60s per-user rate limit via audit_log
- quality-check: add write_audit_log (was missing, CLAUDE.md violation)
- investigation POST: 409 if investigation already exists for incident
- incidents POST: 60s per-user rate limit via audit_log
- addenda GET: restrict to hse/admin/supervisor roles
- dashboard/stats GET: restrict to hse/admin/management roles

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

app/api/incidents/[id]/ai/triage-suggest/route.ts

@@ -18,6 +18,16 @@ export async function POST(
   if (!profile || !['hse', 'admin'].includes(profile.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const since = new Date(Date.now() - 60_000).toISOString()
+  const { count: recentCount } = await supabase
+    .from('audit_log')
+    .select('id', { count: 'exact', head: true })
+    .eq('changed_by', user.id)
+    .eq('action', 'ai_triage_suggest')
+    .gte('changed_at', since)
+  if ((recentCount ?? 0) > 0)
+    return NextResponse.json({ error: 'Rate limited — please wait 60 seconds' }, { status: 429 })
+
   const anthropicKey = await getApiKey(supabase, 'ANTHROPIC_API_KEY')
   const anthropic = createAnthropicClient(anthropicKey)