fix: RLS guard in match_incidents + try/catch around AI/embed calls

- Add new migration 20260711000013_match_incidents_auth_guard.sql that
  replaces match_incidents with an inline auth guard: callers without
  hse/admin role receive PGRST301 Forbidden, closing the SECURITY
  DEFINER RLS bypass.
- Wrap anthropic.messages.create() in try/catch returning 503 in all
  four AI routes: quality-check, triage-suggest, rca-draft, similar.
- Wrap JSON.parse(inc.embedding) and embedText() in similar/route.ts
  in a shared try/catch returning 503 Embedding service unavailable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

app/api/incidents/[id]/ai/rca-draft/route.ts

@@ -41,45 +41,47 @@ export async function POST(
   const siteName = (incident.sites as unknown as { name: string } | null)?.name ?? 'Unknown'
   const zoneName = (incident.zones as unknown as { name: string } | null)?.name ?? 'Unknown'
 
-  const message = await anthropic.messages.create({
-    model: 'claude-opus-4-8',
-    thinking: { type: 'adaptive' },
-    max_tokens: 2048,
-    tools: [{
-      name: 'draft_rca',
-      description: 'Draft a 5-Why root cause analysis and CAPA suggestions for an HSE incident',
-      input_schema: {
-        type: 'object' as const,
-        properties: {
-          five_why_steps: {
-            type: 'array',
-            items: {
-              type: 'object',
-              properties: {
-                why: { type: 'string', description: 'The why question' },
-                answer: { type: 'string', description: 'The finding or answer' },
+  let message: Awaited<ReturnType<typeof anthropic.messages.create>>
+  try {
+    message = await anthropic.messages.create({
+      model: 'claude-opus-4-8',
+      thinking: { type: 'adaptive' },
+      max_tokens: 2048,
+      tools: [{
+        name: 'draft_rca',
+        description: 'Draft a 5-Why root cause analysis and CAPA suggestions for an HSE incident',
+        input_schema: {
+          type: 'object' as const,
+          properties: {
+            five_why_steps: {
+              type: 'array',
+              items: {
+                type: 'object',
+                properties: {
+                  why: { type: 'string', description: 'The why question' },
+                  answer: { type: 'string', description: 'The finding or answer' },
+                },
+                required: ['why', 'answer'],
               },
-              required: ['why', 'answer'],
+              description: '3 to 5 why steps',
+            },
+            root_cause_summary: {
+              type: 'string',
+              description: 'One-sentence root cause statement',
+            },
+            capa_suggestions: {
+              type: 'array',
+              items: { type: 'string' },
+              description: 'Up to 3 corrective/preventive action suggestions',
             },
-            description: '3 to 5 why steps',
-          },
-          root_cause_summary: {
-            type: 'string',
-            description: 'One-sentence root cause statement',
-          },
-          capa_suggestions: {
-            type: 'array',
-            items: { type: 'string' },
-            description: 'Up to 3 corrective/preventive action suggestions',
           },
+          required: ['five_why_steps', 'root_cause_summary', 'capa_suggestions'],
         },
-        required: ['five_why_steps', 'root_cause_summary', 'capa_suggestions'],
-      },
-    }],
-    tool_choice: { type: 'tool', name: 'draft_rca' },
-    messages: [{
-      role: 'user',
-      content: `You are an experienced HSE investigator for a Malaysian 3PL warehouse. Draft a 5-Why root cause analysis for this incident.
+      }],
+      tool_choice: { type: 'tool', name: 'draft_rca' },
+      messages: [{
+        role: 'user',
+        content: `You are an experienced HSE investigator for a Malaysian 3PL warehouse. Draft a 5-Why root cause analysis for this incident.
 
 Site: ${siteName}
 Zone: ${zoneName}
@@ -92,8 +94,11 @@ Serious bodily injury: ${inc.is_serious_bodily_injury ? 'yes' : 'no'}
 Triage notes: ${inc.triage_notes ?? 'none'}
 
 Provide 3–5 Why steps drilling from immediate cause to root cause. Give a one-sentence root cause statement. Suggest 3 corrective/preventive actions appropriate for a Malaysian warehouse context.`,
-    }],
-  })
+      }],
+    })
+  } catch {
+    return NextResponse.json({ error: 'AI service unavailable' }, { status: 503 })
+  }
 
   const toolBlock = message.content.find(b => b.type === 'tool_use')
   if (!toolBlock || toolBlock.type !== 'tool_use')