feat(db): phase 4 group 3 — incident routes to Drizzle

Convert all 11 incident API routes from Supabase PostgREST to Drizzle
ORM with withUser/asAdmin/writeAuditLog patterns and RLS enforcement.
Only uploadEvidenceFile retains supabase client (Phase 5 storage work).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/incidents/[id]/addenda/route.ts

@@ -1,8 +1,12 @@
 export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
-import { createClient } from '@/lib/supabase/server'
+import { aliasedTable } from 'drizzle-orm'
 import { getSession } from '@/lib/auth/get-session'
+import { withUser } from '@/lib/db/with-user'
+import { writeAuditLog } from '@/lib/db/audit'
+import { incidentAddenda, users } from '@/lib/db/schema'
+import { eq, asc } from 'drizzle-orm'
 
 export async function GET(
   _request: NextRequest,
@@ -14,16 +18,24 @@ export async function GET(
   if (!['hse', 'admin', 'supervisor'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
+  const authorAlias = aliasedTable(users, 'author_user')
+  const data = await withUser(session.sub, async tx =>
+    tx.select({
+      id: incidentAddenda.id,
+      body: incidentAddenda.body,
+      createdAt: incidentAddenda.createdAt,
+      authorName: authorAlias.name,
+    })
+    .from(incidentAddenda)
+    .leftJoin(authorAlias, eq(incidentAddenda.author, authorAlias.id))
+    .where(eq(incidentAddenda.incidentId, id))
+    .orderBy(asc(incidentAddenda.createdAt))
+  )
 
-  const { data, error } = await supabase
-    .from('incident_addenda')
-    .select('id, body, created_at, author:users!author (name)')
-    .eq('incident_id', id)
-    .order('created_at', { ascending: true })
-
-  if (error) return NextResponse.json({ error: 'Fetch failed' }, { status: 500 })
-  return NextResponse.json(data ?? [])
+  return NextResponse.json(data.map(a => ({
+    id: a.id, body: a.body, created_at: a.createdAt,
+    author: { name: a.authorName },
+  })))
 }
 
 export async function POST(
@@ -36,28 +48,27 @@ export async function POST(
   if (!['hse', 'admin', 'supervisor'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-
   const body: { body?: string } = await request.json().catch(() => ({}))
   const text = (body.body ?? '').trim()
   if (!text) return NextResponse.json({ error: 'body required' }, { status: 422 })
   if (text.length > 5000)
     return NextResponse.json({ error: 'body must be 5000 characters or fewer' }, { status: 422 })
 
-  const { data: addendum, error } = await supabase
-    .from('incident_addenda')
-    .insert({ incident_id: id, author: session.sub, body: text })
-    .select('id')
-    .single()
+  let addendumId!: string
+  await withUser(session.sub, async tx => {
+    const [addendum] = await tx.insert(incidentAddenda).values({
+      incidentId: id,
+      author: session.sub,
+      body: text,
+    }).returning({ id: incidentAddenda.id })
 
-  if (error || !addendum) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
+    if (!addendum) throw new Error('Insert failed')
+    addendumId = addendum.id
 
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'incident_addenda',
-    p_record_id: addendum.id,
-    p_action: 'INSERT',
-    p_new_value: { incident_id: id, author: session.sub, body: text },
+    await writeAuditLog(tx, 'incident_addenda', addendum.id, 'INSERT', {
+      incident_id: id, author: session.sub, body: text,
+    })
   })
 
-  return NextResponse.json({ id: addendum.id }, { status: 201 })
+  return NextResponse.json({ id: addendumId }, { status: 201 })
 }