feat: Phase 5 & 6 — usability, compliance hardening, analytics

Phase 5 (usability + compliance):
- In-app notification bell/badge: migration 016 adds read state + per-user
  RLS + create_in_app_notification SECURITY DEFINER RPC; /api/notifications;
  wired into incident creation, CAPA assign/verify, escalation cron
- Incident closure: new POST /api/incidents/[id]/close (requires verification
  status + all CAPAs verified); migration 017 locks closed incidents at DB
  level (update/delete triggers) with append-only incident_addenda + UI panel
- Server-side pagination on HSE/supervisor incident inboxes (.range, 25/page)
- Investigation form: alcohol/urine test result + witness statement refs
  (existing schema columns, now editable)
- Type-specific intake fields: migration 018 adds incidents.type_details
  JSONB; whitelist validation; environmental/asset/security/fire field
  groups in report form; EN/MS/ZH labels; offline queue support
- JKKP 8 annual register CSV export (/api/reports/jkkp8) + dashboard button
  + January statutory deadline banner
- Admin page: user invite (service-role client), role/site/active management,
  site + zone CRUD with QR report links — replaces Phase 0 stub
- Evidence gallery thumbnails via Supabase render transform with fallback

Phase 6 (analytics):
- 12-month stacked trend chart (leading/lagging/other) + top root causes
  (lib/dashboard/trends.ts pure helpers)
- AI rising-risk zones: /api/dashboard/ai/risk-flags aggregates 90-day
  zone stats, claude-opus-4-8 forced tool_use, panel on HSE + management
  dashboards, suggestion audit-logged

Also fixes 9 pre-existing missing /ims basePath prefixes in client fetches
and download links.

132 tests passing, tsc clean, next build clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

lib/dashboard/trends.ts

@@ -0,0 +1,70 @@
+export interface MonthlyBucket {
+  month: string // YYYY-MM
+  label: string // e.g. "Jul"
+  total: number
+  leading: number // hazard + near_miss
+  lagging: number // injury
+}
+
+const LEADING_TYPES = ['hazard', 'near_miss']
+
+export function bucketIncidentsByMonth(
+  incidents: Array<{ reported_at: string; incident_type: string }>,
+  months = 12,
+  now = new Date(),
+): MonthlyBucket[] {
+  const buckets: MonthlyBucket[] = []
+  const index = new Map<string, MonthlyBucket>()
+
+  for (let i = months - 1; i >= 0; i--) {
+    const d = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() - i, 1))
+    const month = `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}`
+    const bucket: MonthlyBucket = {
+      month,
+      label: d.toLocaleString('en', { month: 'short', timeZone: 'UTC' }),
+      total: 0,
+      leading: 0,
+      lagging: 0,
+    }
+    buckets.push(bucket)
+    index.set(month, bucket)
+  }
+
+  for (const inc of incidents) {
+    const month = inc.reported_at.slice(0, 7)
+    const bucket = index.get(month)
+    if (!bucket) continue
+    bucket.total++
+    if (LEADING_TYPES.includes(inc.incident_type)) bucket.leading++
+    if (inc.incident_type === 'injury') bucket.lagging++
+  }
+
+  return buckets
+}
+
+export interface RootCauseCount {
+  cause: string
+  count: number
+}
+
+// Root causes are free text (investigations.root_cause_summary); group on a
+// normalized form so trivially different phrasings still collapse together.
+export function topRootCauses(
+  investigations: Array<{ root_cause_summary: string | null }>,
+  top = 5,
+): RootCauseCount[] {
+  const counts = new Map<string, { cause: string; count: number }>()
+
+  for (const inv of investigations) {
+    const raw = (inv.root_cause_summary ?? '').trim()
+    if (!raw) continue
+    const key = raw.toLowerCase().replace(/\s+/g, ' ').replace(/[.。]$/, '')
+    const entry = counts.get(key)
+    if (entry) entry.count++
+    else counts.set(key, { cause: raw, count: 1 })
+  }
+
+  return [...counts.values()]
+    .sort((a, b) => b.count - a.count)
+    .slice(0, top)
+}