feat(db): phase 4 group 3 — incident routes to Drizzle

Convert all 11 incident API routes from Supabase PostgREST to Drizzle
ORM with withUser/asAdmin/writeAuditLog patterns and RLS enforcement.
Only uploadEvidenceFile retains supabase client (Phase 5 storage work).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/incidents/[id]/investigation/route.ts

@@ -1,8 +1,11 @@
 export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
-import { createClient } from '@/lib/supabase/server'
 import { getSession } from '@/lib/auth/get-session'
+import { withUser } from '@/lib/db/with-user'
+import { writeAuditLog } from '@/lib/db/audit'
+import { incidents, investigations } from '@/lib/db/schema'
+import { eq, and, sql } from 'drizzle-orm'
 
 export async function POST(
   request: NextRequest,
@@ -14,56 +17,47 @@ export async function POST(
   if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-
-  const { data: incident } = await supabase
-    .from('incidents').select('status').eq('id', id).single()
+  const [incident] = await withUser(session.sub, async tx =>
+    tx.select({ status: incidents.status }).from(incidents).where(eq(incidents.id, id)).limit(1)
+  )
   if (!incident) return NextResponse.json({ error: 'Not found' }, { status: 404 })
   if (incident.status !== 'triaged')
     return NextResponse.json({ error: 'Incident must be triaged first' }, { status: 409 })
 
-  const { count: existingCount } = await supabase
-    .from('investigations')
-    .select('id', { count: 'exact', head: true })
-    .eq('incident_id', id)
-  if ((existingCount ?? 0) > 0)
+  const [existingCount] = await withUser(session.sub, async tx =>
+    tx.select({ cnt: sql<number>`count(*)` }).from(investigations).where(eq(investigations.incidentId, id))
+  )
+  if (Number(existingCount?.cnt ?? 0) > 0)
     return NextResponse.json({ error: 'Investigation already exists for this incident' }, { status: 409 })
 
   const body = await request.json()
   const method: 'five_why' | 'fishbone' | 'other' = body.method ?? 'five_why'
 
-  const { data: inv, error } = await supabase
-    .from('investigations')
-    .insert({
-      incident_id: id,
-      investigator_id: session.sub,
+  let invId!: string
+  await withUser(session.sub, async tx => {
+    const [inv] = await tx.insert(investigations).values({
+      incidentId: id,
+      investigatorId: session.sub,
       method,
-      findings_text: body.findings_text ?? null,
-      root_cause_summary: body.root_cause_summary ?? null,
-      five_why_steps: method === 'five_why' ? (body.five_why_steps ?? []) : null,
-      fishbone_categories: method === 'fishbone' ? (body.fishbone_categories ?? []) : null,
-      alcohol_test_result: body.alcohol_test_result ?? null,
-      urine_test_result: body.urine_test_result ?? null,
-      witness_statement_refs: Array.isArray(body.witness_statement_refs) ? body.witness_statement_refs : [],
+      findingsText: body.findings_text ?? null,
+      rootCauseSummary: body.root_cause_summary ?? null,
+      fiveWhySteps: method === 'five_why' ? (body.five_why_steps ?? []) : null,
+      fishboneCategories: method === 'fishbone' ? (body.fishbone_categories ?? []) : null,
+      alcoholTestResult: body.alcohol_test_result ?? null,
+      urineTestResult: body.urine_test_result ?? null,
+      witnessStatementRefs: Array.isArray(body.witness_statement_refs) ? body.witness_statement_refs : [],
+    }).returning({ id: investigations.id })
+
+    if (!inv) throw new Error('Insert failed')
+    invId = inv.id
+
+    await tx.update(incidents).set({ status: 'investigating' }).where(eq(incidents.id, id))
+    await writeAuditLog(tx, 'incidents', id, 'investigation_started', {
+      status: 'investigating', investigation_id: inv.id,
     })
-    .select('id')
-    .single()
-
-  if (error || !inv) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
-
-  await supabase
-    .from('incidents')
-    .update({ status: 'investigating' })
-    .eq('id', id)
-
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'incidents',
-    p_record_id: id,
-    p_action: 'investigation_started',
-    p_new_value: { status: 'investigating', investigation_id: inv.id },
   })
 
-  return NextResponse.json({ id: inv.id })
+  return NextResponse.json({ id: invId })
 }
 
 export async function PATCH(
@@ -76,45 +70,32 @@ export async function PATCH(
   if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-
   const body = await request.json()
   const { investigation_id, complete, ...fields } = body
 
   if (!investigation_id) return NextResponse.json({ error: 'investigation_id required' }, { status: 422 })
 
-  const updateData: Record<string, unknown> = {
-    findings_text: fields.findings_text ?? null,
-    root_cause_summary: fields.root_cause_summary ?? null,
-    five_why_steps: fields.five_why_steps ?? null,
-    fishbone_categories: fields.fishbone_categories ?? null,
-    alcohol_test_result: fields.alcohol_test_result ?? null,
-    urine_test_result: fields.urine_test_result ?? null,
-    witness_statement_refs: Array.isArray(fields.witness_statement_refs) ? fields.witness_statement_refs : [],
+  const updateData: Partial<typeof investigations.$inferInsert> = {
+    findingsText: fields.findings_text ?? null,
+    rootCauseSummary: fields.root_cause_summary ?? null,
+    fiveWhySteps: fields.five_why_steps ?? null,
+    fishboneCategories: fields.fishbone_categories ?? null,
+    alcoholTestResult: fields.alcohol_test_result ?? null,
+    urineTestResult: fields.urine_test_result ?? null,
+    witnessStatementRefs: Array.isArray(fields.witness_statement_refs) ? fields.witness_statement_refs : [],
   }
-  if (complete) updateData.completed_at = new Date().toISOString()
+  if (complete) updateData.completedAt = new Date()
 
-  const { error } = await supabase
-    .from('investigations')
-    .update(updateData)
-    .eq('id', investigation_id)
-    .eq('incident_id', id)
+  await withUser(session.sub, async tx => {
+    await tx.update(investigations)
+      .set(updateData)
+      .where(and(eq(investigations.id, investigation_id), eq(investigations.incidentId, id)))
 
-  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })
-
-  if (complete) {
-    await supabase
-      .from('incidents')
-      .update({ status: 'capa_pending' })
-      .eq('id', id)
-
-    await supabase.rpc('write_audit_log', {
-      p_table_name: 'incidents',
-      p_record_id: id,
-      p_action: 'investigation_completed',
-      p_new_value: { status: 'capa_pending' },
-    })
-  }
+    if (complete) {
+      await tx.update(incidents).set({ status: 'capa_pending' }).where(eq(incidents.id, id))
+      await writeAuditLog(tx, 'incidents', id, 'investigation_completed', { status: 'capa_pending' })
+    }
+  })
 
   return NextResponse.json({ ok: true })
 }