feat: Phase 5 & 6 — usability, compliance hardening, analytics

Phase 5 (usability + compliance):
- In-app notification bell/badge: migration 016 adds read state + per-user
  RLS + create_in_app_notification SECURITY DEFINER RPC; /api/notifications;
  wired into incident creation, CAPA assign/verify, escalation cron
- Incident closure: new POST /api/incidents/[id]/close (requires verification
  status + all CAPAs verified); migration 017 locks closed incidents at DB
  level (update/delete triggers) with append-only incident_addenda + UI panel
- Server-side pagination on HSE/supervisor incident inboxes (.range, 25/page)
- Investigation form: alcohol/urine test result + witness statement refs
  (existing schema columns, now editable)
- Type-specific intake fields: migration 018 adds incidents.type_details
  JSONB; whitelist validation; environmental/asset/security/fire field
  groups in report form; EN/MS/ZH labels; offline queue support
- JKKP 8 annual register CSV export (/api/reports/jkkp8) + dashboard button
  + January statutory deadline banner
- Admin page: user invite (service-role client), role/site/active management,
  site + zone CRUD with QR report links — replaces Phase 0 stub
- Evidence gallery thumbnails via Supabase render transform with fallback

Phase 6 (analytics):
- 12-month stacked trend chart (leading/lagging/other) + top root causes
  (lib/dashboard/trends.ts pure helpers)
- AI rising-risk zones: /api/dashboard/ai/risk-flags aggregates 90-day
  zone stats, claude-opus-4-8 forced tool_use, panel on HSE + management
  dashboards, suggestion audit-logged

Also fixes 9 pre-existing missing /ims basePath prefixes in client fetches
and download links.

132 tests passing, tsc clean, next build clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

lib/reports/jkkp8.ts

@@ -0,0 +1,96 @@
+import { computeDoshObligation } from '@/lib/incidents/dosh'
+
+export interface Jkkp8Incident {
+  reference_no: string | null
+  incident_type: string
+  description: string
+  reported_at: string
+  medical_status: string | null
+  lost_days: number | null
+  is_fatality: boolean
+  is_serious_bodily_injury: boolean
+  is_dangerous_occurrence: boolean
+  is_occupational_disease: boolean
+  sites: { name: string } | null
+  zones: { name: string } | null
+  reporter: { name: string } | null
+  dosh_reports: Array<{ form_type: string; status: string; submitted_at: string | null }>
+}
+
+export interface Jkkp8Row {
+  reference: string
+  date: string
+  site: string
+  zone: string
+  incident_type: string
+  reported_by: string
+  description: string
+  medical_status: string
+  lost_days: string
+  obligation: string
+  filing_status: string
+}
+
+// JKKP 8 annual register: every incident with any NADOPOD obligation for the
+// year (PRD §9 — "Any of the above → also logged in the JKKP 8 annual register").
+export function buildJkkp8Rows(incidents: Jkkp8Incident[]): Jkkp8Row[] {
+  const rows: Jkkp8Row[] = []
+
+  for (const inc of incidents) {
+    const obligation = computeDoshObligation(inc)
+    const reportable =
+      obligation.requires_jkkp6 || obligation.requires_jkkp7 || obligation.requires_jkkp8
+    if (!reportable) continue
+
+    const filings = inc.dosh_reports ?? []
+    const filingStatus =
+      filings.length === 0
+        ? 'pending'
+        : filings
+            .map(f => `${f.form_type.toUpperCase()}: ${f.status}${f.submitted_at ? ` (${f.submitted_at.split('T')[0]})` : ''}`)
+            .join('; ')
+
+    rows.push({
+      reference: inc.reference_no ?? '',
+      date: inc.reported_at.split('T')[0],
+      site: inc.sites?.name ?? '',
+      zone: inc.zones?.name ?? '',
+      incident_type: inc.incident_type,
+      reported_by: inc.reporter?.name ?? '',
+      description: inc.description,
+      medical_status: inc.medical_status ?? '',
+      lost_days: String(inc.lost_days ?? ''),
+      obligation: obligation.reasons.join('; '),
+      filing_status: filingStatus,
+    })
+  }
+
+  return rows
+}
+
+export const JKKP8_HEADERS = [
+  'Reference', 'Date', 'Site', 'Zone', 'Incident Type', 'Reported By',
+  'Description', 'Medical Status', 'Lost Days', 'NADOPOD Obligation', 'DOSH Filing Status',
+]
+
+export function escapeCsv(value: string | number | null | undefined): string {
+  if (value === null || value === undefined) return ''
+  const str = String(value)
+  if (str.includes(',') || str.includes('"') || str.includes('\n')) {
+    return `"${str.replace(/"/g, '""')}"`
+  }
+  return str
+}
+
+export function jkkp8Csv(rows: Jkkp8Row[]): string {
+  const lines = [JKKP8_HEADERS.map(escapeCsv).join(',')]
+  for (const r of rows) {
+    lines.push(
+      [
+        r.reference, r.date, r.site, r.zone, r.incident_type, r.reported_by,
+        r.description, r.medical_status, r.lost_days, r.obligation, r.filing_status,
+      ].map(escapeCsv).join(','),
+    )
+  }
+  return lines.join('\r\n')
+}