fix: allow admin role to submit triage and investigation API routes

API routes were hse-only, blocking admin from saving triage/investigation
forms even after the page-level guards were fixed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

app/api/incidents/[id]/triage/route.ts

@@ -24,7 +24,7 @@ export async function PATCH(
 
   const { data: profile } = await supabase
     .from('users').select('role').eq('id', user.id).single()
-  if (!profile || profile.role !== 'hse')
+  if (!profile || !['hse', 'admin'].includes(profile.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
   const body: TriageBody = await request.json()