feat: Phase 1 foundation - incident components, storage, and migrations

supabase/migrations/20260710000010_storage.sql

@@ -0,0 +1,37 @@
+-- Create evidence storage bucket (private)
+INSERT INTO storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+VALUES (
+  'evidence',
+  'evidence',
+  false,
+  209715200, -- 200MB
+  ARRAY[
+    'image/jpeg', 'image/png', 'image/heic', 'image/webp',
+    'video/mp4', 'video/quicktime',
+    'application/pdf',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
+  ]
+)
+ON CONFLICT (id) DO NOTHING;
+
+-- RLS on storage.objects for the evidence bucket
+CREATE POLICY "evidence_upload_authenticated"
+  ON storage.objects FOR INSERT
+  TO authenticated
+  WITH CHECK (bucket_id = 'evidence');
+
+CREATE POLICY "evidence_read_uploader"
+  ON storage.objects FOR SELECT
+  TO authenticated
+  USING (
+    bucket_id = 'evidence'
+    AND auth.uid()::text = (storage.foldername(name))[1]
+  );
+
+CREATE POLICY "evidence_read_elevated"
+  ON storage.objects FOR SELECT
+  TO authenticated
+  USING (
+    bucket_id = 'evidence'
+    AND public.auth_user_role() IN ('hse', 'admin', 'management', 'supervisor')
+  );