fix(db): phase 4 group 6 — session guard, type safety, SQL filter fixes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/(protected)/hse/dashboard/page.tsx

@@ -5,7 +5,7 @@ import { asAdmin } from '@/lib/db/with-user'
 import { redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth/get-session'
 import { incidents, sites, zones, capaActions, doshReports, investigations } from '@/lib/db/schema'
-import { eq, gte, isNotNull } from 'drizzle-orm'
+import { eq, gte, isNotNull, and } from 'drizzle-orm'
 import { StatCard } from '@/components/dashboard/stat-card'
 import { bucketIncidentsByMonth, topRootCauses } from '@/lib/dashboard/trends'
 import { RiskFlagsPanel } from '@/components/dashboard/risk-flags-panel'
@@ -67,8 +67,8 @@ export default async function HseDashboardPage({
       db.select({ zoneName: zones.name })
       .from(incidents)
       .leftJoin(zones, eq(incidents.zoneId, zones.id))
-      .where(gte(incidents.reportedAt, ninetyDaysAgo))
-    ).then(rows => rows.filter(r => r.zoneName !== null)),
+      .where(and(gte(incidents.reportedAt, ninetyDaysAgo), isNotNull(incidents.zoneId)))
+    ),
     asAdmin(db =>
       db.select({
         dueDate: capaActions.dueDate,
@@ -133,6 +133,7 @@ export default async function HseDashboardPage({
 
   const capas = completedCapas
   const onTime = capas.filter(c => {
+    if (!c.dueDate) return false
     const due = new Date(c.dueDate)
     const done = c.verifiedAt
       ? new Date(c.verifiedAt)