feat: Phase 5 & 6 — usability, compliance hardening, analytics

Phase 5 (usability + compliance):
- In-app notification bell/badge: migration 016 adds read state + per-user
  RLS + create_in_app_notification SECURITY DEFINER RPC; /api/notifications;
  wired into incident creation, CAPA assign/verify, escalation cron
- Incident closure: new POST /api/incidents/[id]/close (requires verification
  status + all CAPAs verified); migration 017 locks closed incidents at DB
  level (update/delete triggers) with append-only incident_addenda + UI panel
- Server-side pagination on HSE/supervisor incident inboxes (.range, 25/page)
- Investigation form: alcohol/urine test result + witness statement refs
  (existing schema columns, now editable)
- Type-specific intake fields: migration 018 adds incidents.type_details
  JSONB; whitelist validation; environmental/asset/security/fire field
  groups in report form; EN/MS/ZH labels; offline queue support
- JKKP 8 annual register CSV export (/api/reports/jkkp8) + dashboard button
  + January statutory deadline banner
- Admin page: user invite (service-role client), role/site/active management,
  site + zone CRUD with QR report links — replaces Phase 0 stub
- Evidence gallery thumbnails via Supabase render transform with fallback

Phase 6 (analytics):
- 12-month stacked trend chart (leading/lagging/other) + top root causes
  (lib/dashboard/trends.ts pure helpers)
- AI rising-risk zones: /api/dashboard/ai/risk-flags aggregates 90-day
  zone stats, claude-opus-4-8 forced tool_use, panel on HSE + management
  dashboards, suggestion audit-logged

Also fixes 9 pre-existing missing /ims basePath prefixes in client fetches
and download links.

132 tests passing, tsc clean, next build clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

tests/lib/dashboard/trends.test.ts

@@ -0,0 +1,56 @@
+import { describe, it, expect } from 'vitest'
+import { bucketIncidentsByMonth, topRootCauses } from '@/lib/dashboard/trends'
+
+describe('bucketIncidentsByMonth', () => {
+  const now = new Date('2026-07-15T12:00:00Z')
+
+  it('returns one bucket per month, oldest first', () => {
+    const buckets = bucketIncidentsByMonth([], 3, now)
+    expect(buckets.map(b => b.month)).toEqual(['2026-05', '2026-06', '2026-07'])
+  })
+
+  it('counts leading and lagging types into the right month', () => {
+    const buckets = bucketIncidentsByMonth(
+      [
+        { reported_at: '2026-07-01T08:00:00Z', incident_type: 'near_miss' },
+        { reported_at: '2026-07-02T08:00:00Z', incident_type: 'hazard' },
+        { reported_at: '2026-07-03T08:00:00Z', incident_type: 'injury' },
+        { reported_at: '2026-06-03T08:00:00Z', incident_type: 'fire' },
+      ],
+      3,
+      now,
+    )
+    const july = buckets.find(b => b.month === '2026-07')!
+    expect(july).toMatchObject({ total: 3, leading: 2, lagging: 1 })
+    expect(buckets.find(b => b.month === '2026-06')).toMatchObject({ total: 1, leading: 0, lagging: 0 })
+  })
+
+  it('ignores incidents outside the window', () => {
+    const buckets = bucketIncidentsByMonth(
+      [{ reported_at: '2025-01-01T08:00:00Z', incident_type: 'injury' }],
+      3,
+      now,
+    )
+    expect(buckets.every(b => b.total === 0)).toBe(true)
+  })
+})
+
+describe('topRootCauses', () => {
+  it('groups normalized duplicates and sorts by count', () => {
+    const result = topRootCauses([
+      { root_cause_summary: 'Inadequate forklift training.' },
+      { root_cause_summary: 'inadequate  forklift training' },
+      { root_cause_summary: 'Blocked walkway' },
+      { root_cause_summary: null },
+      { root_cause_summary: '' },
+    ])
+    expect(result).toHaveLength(2)
+    expect(result[0]).toMatchObject({ count: 2 })
+    expect(result[0].cause.toLowerCase()).toContain('forklift')
+  })
+
+  it('limits to top N', () => {
+    const invs = ['a', 'b', 'c', 'd', 'e', 'f'].map(c => ({ root_cause_summary: c }))
+    expect(topRootCauses(invs, 5)).toHaveLength(5)
+  })
+})