feat: incident report form, API route, middleware shared-route + redirect

tests/api/incidents.test.ts

@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest'
+import { validateIncidentInput } from '@/lib/incidents/validate'
+
+describe('incident report validation', () => {
+  it('rejects empty zone_token', () => {
+    const result = validateIncidentInput({
+      zone_token: '',
+      incident_type: 'near_miss',
+      description: 'Forklift nearly hit a worker',
+      injury_involved: false,
+      asset_involved: false,
+    })
+    expect(result.ok).toBe(false)
+    expect(result.errors).toContain('zone_token is required')
+  })
+
+  it('requires medical_status for injury', () => {
+    const result = validateIncidentInput({
+      zone_token: 'scw1-dock-a-qr-2026',
+      incident_type: 'injury',
+      description: 'Worker slipped on wet floor near cold storage entrance',
+      injury_involved: true,
+      asset_involved: false,
+    })
+    expect(result.ok).toBe(false)
+    expect(result.errors).toContain('medical_status is required when injury is involved')
+  })
+})