fix: RLS guard in match_incidents + try/catch around AI/embed calls

- Add new migration 20260711000013_match_incidents_auth_guard.sql that
  replaces match_incidents with an inline auth guard: callers without
  hse/admin role receive PGRST301 Forbidden, closing the SECURITY
  DEFINER RLS bypass.
- Wrap anthropic.messages.create() in try/catch returning 503 in all
  four AI routes: quality-check, triage-suggest, rca-draft, similar.
- Wrap JSON.parse(inc.embedding) and embedText() in similar/route.ts
  in a shared try/catch returning 503 Embedding service unavailable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

app/api/incidents/[id]/similar/route.ts

@@ -27,13 +27,17 @@ export async function GET(
   const inc = incident as { id: string; description: string; embedding: string | null }
 
   let embeddingVec: number[]
-  if (inc.embedding) {
-    embeddingVec = JSON.parse(inc.embedding) as number[]
-  } else {
-    embeddingVec = await embedText(inc.description)
-    await supabase.from('incidents').update({
-      embedding: `[${embeddingVec.join(',')}]` as unknown as string,
-    }).eq('id', id)
+  try {
+    if (inc.embedding) {
+      embeddingVec = JSON.parse(inc.embedding) as number[]
+    } else {
+      embeddingVec = await embedText(inc.description)
+      await supabase.from('incidents').update({
+        embedding: `[${embeddingVec.join(',')}]` as unknown as string,
+      }).eq('id', id)
+    }
+  } catch {
+    return NextResponse.json({ error: 'Embedding service unavailable' }, { status: 503 })
   }
 
   const { data: similar } = await supabase.rpc('match_incidents', {