feat: delete + deactivate for sites, zones, and trucks; harden incident API error handling

- zones: add active column (migration 20260713000005)
- sites/zones API: PATCH (toggle active) + DELETE (blocked when incidents reference it)
- trucks API: PATCH + DELETE with same pattern
- admin page: select active for sites + zones
- site-zone-manager + truck-manager: deactivate toggle + delete button per row with busyId
- incidents API: reject reports on deactivated zone/site; wrap handler in top-level try-catch so unhandled errors return JSON (not HTML)
- report-form: parse JSON separately so HTTP status code surfaces instead of generic "Something went wrong"

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

app/api/admin/sites/route.ts

@@ -45,3 +45,68 @@ export async function POST(request: NextRequest) {
   })
   return NextResponse.json({ id: site.id }, { status: 201 })
 }
+
+export async function PATCH(request: NextRequest) {
+  const { supabase, user } = await requireAdmin()
+  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
+  const body: { kind?: 'site' | 'zone'; id?: string; active?: boolean } =
+    await request.json().catch(() => ({}))
+  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
+  const table = body.kind === 'zone' ? 'zones' : 'sites'
+
+  const { data: before } = await supabase.from(table).select('*').eq('id', body.id).single()
+  const { error } = await supabase.from(table).update({ active: body.active }).eq('id', body.id)
+  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })
+
+  await supabase.rpc('write_audit_log', {
+    p_table_name: table,
+    p_record_id: body.id,
+    p_action: 'admin_update',
+    p_old_value: before,
+    p_new_value: { active: body.active },
+  })
+  return NextResponse.json({ ok: true })
+}
+
+export async function DELETE(request: NextRequest) {
+  const { supabase, user } = await requireAdmin()
+  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
+  const body: { kind?: 'site' | 'zone'; id?: string } = await request.json().catch(() => ({}))
+  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
+  const table = body.kind === 'zone' ? 'zones' : 'sites'
+  const col = body.kind === 'zone' ? 'zone_id' : 'site_id'
+
+  // Count referencing incidents for a clear, actionable error message
+  const { count } = await supabase
+    .from('incidents')
+    .select('id', { count: 'exact', head: true })
+    .eq(col, body.id)
+  if ((count ?? 0) > 0)
+    return NextResponse.json(
+      { error: `Cannot delete — ${count} incident(s) reference this. Deactivate it instead.` },
+      { status: 409 },
+    )
+
+  const { data: before } = await supabase.from(table).select('*').eq('id', body.id).single()
+  const { error } = await supabase.from(table).delete().eq('id', body.id)
+  if (error)
+    return NextResponse.json(
+      {
+        error:
+          error.code === '23503'
+            ? 'Cannot delete — this is still referenced elsewhere. Deactivate it instead.'
+            : 'Delete failed',
+      },
+      { status: error.code === '23503' ? 409 : 500 },
+    )
+
+  await supabase.rpc('write_audit_log', {
+    p_table_name: table,
+    p_record_id: body.id,
+    p_action: 'DELETE',
+    p_old_value: before,
+  })
+  return NextResponse.json({ ok: true })
+}