feat(db): phase 4 group 3 — incident routes to Drizzle

Convert all 11 incident API routes from Supabase PostgREST to Drizzle
ORM with withUser/asAdmin/writeAuditLog patterns and RLS enforcement.
Only uploadEvidenceFile retains supabase client (Phase 5 storage work).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/incidents/[id]/route.ts

@@ -1,6 +1,9 @@
 import { NextResponse } from 'next/server'
-import { createClient } from '@/lib/supabase/server'
+import { aliasedTable } from 'drizzle-orm'
 import { getSession } from '@/lib/auth/get-session'
+import { withUser } from '@/lib/db/with-user'
+import { incidents, evidenceFiles, sites, zones, users } from '@/lib/db/schema'
+import { eq, and } from 'drizzle-orm'
 
 export const dynamic = 'force-dynamic'
 
@@ -9,34 +12,73 @@ export async function GET(_req: Request, { params }: { params: Promise<{ id: str
   const session = await getSession()
   if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const supabase = await createClient()
-  const role = session.role
+  const reporterAlias = aliasedTable(users, 'reporter')
 
-  const { data: incident, error } = await supabase
-    .from('incidents')
-    .select(`
-      id, reference_no, incident_type, description, severity, status,
-      injury_involved, asset_involved, medical_status, lost_days,
-      reported_at, closed_at,
-      sites (id, name),
-      zones (id, name),
-      reporter:users!reported_by (id, name, email),
-      evidence_files (id, stage, file_url, file_type, uploaded_at)
-    `)
-    .eq('id', id)
-    .eq('evidence_files.deleted', false)
-    .single()
+  const [incident] = await withUser(session.sub, async tx =>
+    tx.select({
+      id: incidents.id,
+      referenceNo: incidents.referenceNo,
+      incidentType: incidents.incidentType,
+      description: incidents.description,
+      severity: incidents.severity,
+      status: incidents.status,
+      injuryInvolved: incidents.injuryInvolved,
+      assetInvolved: incidents.assetInvolved,
+      medicalStatus: incidents.medicalStatus,
+      lostDays: incidents.lostDays,
+      reportedAt: incidents.reportedAt,
+      closedAt: incidents.closedAt,
+      siteId: sites.id,
+      siteName: sites.name,
+      zoneId: zones.id,
+      zoneName: zones.name,
+      reporterId: reporterAlias.id,
+      reporterName: reporterAlias.name,
+      reporterEmail: reporterAlias.email,
+    })
+    .from(incidents)
+    .leftJoin(sites, eq(incidents.siteId, sites.id))
+    .leftJoin(zones, eq(incidents.zoneId, zones.id))
+    .leftJoin(reporterAlias, eq(incidents.reportedBy, reporterAlias.id))
+    .where(eq(incidents.id, id))
+    .limit(1)
+  )
+  if (!incident) return NextResponse.json({ error: 'Not found' }, { status: 404 })
 
-  if (error || !incident) {
-    return NextResponse.json({ error: 'Not found' }, { status: 404 })
-  }
+  const isOwner = incident.reporterId === session.sub
+  const isSiteStaff = ['hse', 'supervisor', 'admin'].includes(session.role)
+  if (!isOwner && !isSiteStaff) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const reporter = incident.reporter as unknown as { id: string } | null
-  const isOwner = reporter?.id === session.sub
-  const isSiteStaff = ['hse', 'supervisor', 'admin'].includes(role)
-  if (!isOwner && !isSiteStaff) {
-    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-  }
+  const evidenceFileRows = await withUser(session.sub, async tx =>
+    tx.select({
+      id: evidenceFiles.id,
+      stage: evidenceFiles.stage,
+      fileUrl: evidenceFiles.fileUrl,
+      fileType: evidenceFiles.fileType,
+      uploadedAt: evidenceFiles.uploadedAt,
+    })
+    .from(evidenceFiles)
+    .where(and(eq(evidenceFiles.incidentId, id), eq(evidenceFiles.deleted, false)))
+  )
 
-  return NextResponse.json(incident)
+  return NextResponse.json({
+    id: incident.id,
+    reference_no: incident.referenceNo,
+    incident_type: incident.incidentType,
+    description: incident.description,
+    severity: incident.severity,
+    status: incident.status,
+    injury_involved: incident.injuryInvolved,
+    asset_involved: incident.assetInvolved,
+    medical_status: incident.medicalStatus,
+    lost_days: incident.lostDays,
+    reported_at: incident.reportedAt,
+    closed_at: incident.closedAt,
+    sites: incident.siteId ? { id: incident.siteId, name: incident.siteName } : null,
+    zones: incident.zoneId ? { id: incident.zoneId, name: incident.zoneName } : null,
+    reporter: incident.reporterId ? { id: incident.reporterId, name: incident.reporterName, email: incident.reporterEmail } : null,
+    evidence_files: evidenceFileRows.map(ef => ({
+      id: ef.id, stage: ef.stage, file_url: ef.fileUrl, file_type: ef.fileType, uploaded_at: ef.uploadedAt,
+    })),
+  })
 }