fix(pdf): sanitise Content-Disposition filename, fix triagedByName test fixture

app/api/incidents/[id]/report-pdf/route.ts

@@ -146,7 +146,8 @@ export async function GET(
     closedAt: incident.closedAt instanceof Date ? incident.closedAt.toISOString() : (incident.closedAt as string | null),
   })
 
-  const filename = `incident-report-${incident.referenceNo ?? id}.pdf`
+  const safeRef = (incident.referenceNo ?? id).replace(/[^A-Za-z0-9\-_.]/g, '_')
+  const filename = `incident-report-${safeRef}.pdf`
 
   return new NextResponse(Buffer.from(pdfBytes), {
     status: 200,

tests/app/api/incidents/report-pdf.test.ts

@@ -42,7 +42,7 @@ const MOCK_INCIDENT = {
   isDangerousOccurrence: false,
   isOccupationalDisease: false,
   lostDays: null,
-  triagedBy: 'Supervisor',
+  triagedByName: 'Supervisor',
   triagedAt: new Date('2026-07-01T10:00:00Z'),
   triageNotes: 'Reviewed',
   closedAt: new Date('2026-07-20T15:00:00Z'),