chore: scaffold Next.js 15 + Supabase clients + vitest

CLAUDE.md

@@ -0,0 +1,57 @@
+# IMS — Claude Code Instructions
+
+## Project
+HSE Incident Management System for Setia Corporation (3PL warehouse).
+Replaces WhatsApp/Excel safety reporting. Client: Ms. Agnes, Mr. Terence, Mr. Yap, Mr. Jensen.
+
+## Stack
+- **Frontend + API routes:** Next.js (App Router)
+- **DB + Auth + Storage:** Supabase (Postgres + RLS + pgvector)
+- **Hosting:** Vercel (frontend) + Supabase cloud
+- **AI:** Claude API — server-side only, never client-side
+- **Email:** Resend
+- **WhatsApp:** Meta WhatsApp Business Cloud API
+- **PDF:** pdf-lib (JKKP form fill)
+- **QR:** qrcode npm package
+
+## Current Phase
+**Phase 0 — Foundation (not started)**
+See `[[phases]]` memory for full phase breakdown and deliverables.
+
+## Dev Conventions
+- Never commit `.env` or API keys. All secrets in env vars only.
+- RLS enforced at DB level for every table — never rely on UI-only hiding.
+- Claude API calls: server-side API routes only (`/app/api/...`).
+- Incident reference format: `SITE-YYYYMM-####`
+- Every DB mutation writes to `audit_log` (table, record_id, action, changed_by, changed_at, old/new value).
+- Evidence files: never hard-delete; retain minimum 5 years (DOSH JKKP 8 requirement).
+- AI suggestions logged to `audit_log` — capture what Claude suggested + what human chose.
+
+## File Structure (target)
+```
+IMS/
+├── docs/                    # PRD, tech spec, roadmap, specs — source of truth
+├── app/                     # Next.js App Router pages + API routes
+├── components/              # Shared UI components
+├── lib/
+│   ├── supabase/            # Supabase client + server helpers
+│   ├── claude/              # Claude API wrappers (server-side)
+│   └── notifications/       # Resend + WhatsApp senders
+├── supabase/
+│   └── migrations/          # SQL migration files
+└── public/
+```
+
+## Deep Context (memory files — load instead of re-reading raw docs)
+- `[[project_overview]]` — objectives, roles, success metrics
+- `[[architecture]]` — module diagram, stack rationale, deployment
+- `[[db_schema]]` — all 10 tables, fields, RLS, pgvector
+- `[[phases]]` — 4 phases + deliverables, current phase
+- `[[compliance]]` — NADOPOD 2004, JKKP 6/7/8 rules
+
+## graphify
+When graphify-out/graph.json exists:
+- Run `graphify query "<question>"` before browsing source.
+- Use `graphify path "<A>" "<B>"` for relationships.
+- Use `graphify explain "<concept>"` for focused concepts.
+- After code changes: `graphify update .`