feat(db): phase 4 group 3 — incident routes to Drizzle

Convert all 11 incident API routes from Supabase PostgREST to Drizzle
ORM with withUser/asAdmin/writeAuditLog patterns and RLS enforcement.
Only uploadEvidenceFile retains supabase client (Phase 5 storage work).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/incidents/[id]/close/route.ts

@@ -1,8 +1,11 @@
 export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
-import { createClient } from '@/lib/supabase/server'
 import { getSession } from '@/lib/auth/get-session'
+import { withUser } from '@/lib/db/with-user'
+import { writeAuditLog } from '@/lib/db/audit'
+import { incidents, capaActions } from '@/lib/db/schema'
+import { eq, and, not, inArray } from 'drizzle-orm'
 import { createInAppNotifications } from '@/lib/notifications/in-app'
 
 export async function POST(
@@ -15,49 +18,43 @@ export async function POST(
   if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-
-  const { data: incident } = await supabase
-    .from('incidents')
-    .select('status, reference_no, reported_by')
-    .eq('id', id)
-    .single()
+  const [incident] = await withUser(session.sub, async tx =>
+    tx.select({ status: incidents.status, referenceNo: incidents.referenceNo, reportedBy: incidents.reportedBy })
+      .from(incidents).where(eq(incidents.id, id)).limit(1)
+  )
   if (!incident) return NextResponse.json({ error: 'Not found' }, { status: 404 })
   if (incident.status === 'closed')
     return NextResponse.json({ error: 'Already closed' }, { status: 409 })
   if (incident.status !== 'verification')
     return NextResponse.json({ error: 'Incident must be in verification status' }, { status: 409 })
 
-  const { data: openCapas } = await supabase
-    .from('capa_actions')
-    .select('id')
-    .eq('incident_id', id)
-    .not('status', 'in', '(verified,closed)')
-  if (openCapas && openCapas.length > 0)
+  const openCapas = await withUser(session.sub, async tx =>
+    tx.select({ id: capaActions.id })
+      .from(capaActions)
+      .where(and(
+        eq(capaActions.incidentId, id),
+        not(inArray(capaActions.status, ['verified', 'closed'])),
+      ))
+  )
+  if (openCapas.length > 0)
     return NextResponse.json({ error: 'All CAPA actions must be verified before closure' }, { status: 409 })
 
-  const closedAt = new Date().toISOString()
-  const { error } = await supabase
-    .from('incidents')
-    .update({ status: 'closed', closed_at: closedAt })
-    .eq('id', id)
-  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })
-
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'incidents',
-    p_record_id: id,
-    p_action: 'closed',
-    p_new_value: { status: 'closed', closed_at: closedAt, closed_by: session.sub },
+  const closedAt = new Date()
+  await withUser(session.sub, async tx => {
+    await tx.update(incidents).set({ status: 'closed', closedAt }).where(eq(incidents.id, id))
+    await writeAuditLog(tx, 'incidents', id, 'closed', {
+      status: 'closed', closed_at: closedAt.toISOString(), closed_by: session.sub,
+    })
   })
 
-  if (incident.reported_by) {
+  if (incident.reportedBy) {
     await createInAppNotifications([{
-      userId: incident.reported_by,
-      title: `Your incident report ${incident.reference_no ?? ''} has been closed`,
+      userId: incident.reportedBy,
+      title: `Your incident report ${incident.referenceNo ?? ''} has been closed`,
       link: '/reporter',
       incidentId: id,
     }])
   }
 
-  return NextResponse.json({ ok: true, closed_at: closedAt })
+  return NextResponse.json({ ok: true, closed_at: closedAt.toISOString() })
 }