feat: incident report form, API route, middleware shared-route + redirect

app/api/incidents/[id]/route.ts

@@ -0,0 +1,32 @@
+import { NextResponse } from 'next/server'
+import { createClient } from '@/lib/supabase/server'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const supabase = await createClient()
+  const { data, error: authError } = await supabase.auth.getUser()
+  if (authError || !data?.user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const { data: incident, error } = await supabase
+    .from('incidents')
+    .select(`
+      id, reference_no, incident_type, description, severity, status,
+      injury_involved, asset_involved, medical_status, lost_days,
+      reported_at, closed_at,
+      sites (id, name),
+      zones (id, name),
+      reporter:users!reported_by (id, name, email),
+      evidence_files (id, stage, file_url, file_type, uploaded_at)
+    `)
+    .eq('id', id)
+    .eq('evidence_files.deleted', false)
+    .single()
+
+  if (error || !incident) {
+    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  }
+
+  return NextResponse.json(incident)
+}