feat: implement permissions and actions management

- Add permissions logic for status options in corrective actions.
- Create tests for permissions functionality.
- Implement queries for user authentication and actions management.
- Develop Actions page to display and manage corrective actions.
- Create authentication pages for login, setup, and password reset.
- Add IncidentDetail page to view incident details and associated actions.
- Implement Settings page for user management and password changes.

docs/ROADMAP.md

@@ -15,6 +15,8 @@ This is a living document. Update it as decisions are made or scope changes.
 | Auth | Email + password (scrypt), server-side sessions in an http-only cookie, four roles: reporter < supervisor < safety manager < admin | Decided |
 | Deployment | Self-hosted, single `docker compose up` (app + Postgres); file storage added with photo upload | Decided |
 | Compliance scope | US OSHA first; data model kept extensible for other regions (e.g. RIDDOR) | Proposed |
+| Incident PDFs | Browser print-to-PDF from a print stylesheet; server-side PDF deferred (see TODO) | Decided |
+| Email | SMTP via `SMTP_URL`; without it, logged in development and dropped in production. Delivery setup deferred (see TODO) | Decided |
 | CI | Gitea Actions (`.gitea/workflows`): lint, typecheck, unit tests, build, e2e | Decided |
 | Product name | Open SafetyLog EHS (replaced placeholder "IA Tracker" and the prototype's "Safesite" branding) | Decided |
 
@@ -46,15 +48,16 @@ This is a living document. Update it as decisions are made or scope changes.
 
 ## Phase 2: Core workflow (MVP)
 
-- Connect the web app to the API: sign-in and first-run setup screens, incident list and report form using real data
-- Photo upload (attachments)
-- Magic-link sign-in and password reset by email
-- Incident detail page: timeline, investigation, root-cause tools (5 Whys, fishbone), corrective actions (CAPA)
-- Status workflow: Reported → Triage → Investigation → Corrective actions → Verification → Closed, with role-based transitions
-- "My actions" list and overdue tracking
-- Email notifications: assignment, due dates, high-severity alerts
-- CSV and PDF export
-- Dashboard metrics computed from real data
+- [x] Web app connected to the API: sign-in, first-run setup, every page on live data (demo data removed from the frontend)
+- [x] Photo and PDF upload, checked by file content (not name), size-limited, served with a sandboxing security policy
+- [x] Magic-link sign-in, password reset by email, email invitations for new users (admins can also set passwords when there's no email)
+- [x] Incident detail page: details editing, activity log (comments + audit trail), investigation with 5 Whys and fishbone (6M) views, corrective actions (CAPA)
+- [x] Status workflow Reported → Triage → Investigation → Corrective actions → Verification → Closed, with role rules and guards (e.g. high severity can't skip investigation; closing needs every action verified), shared between API and UI
+- [x] "My actions" and "All actions" lists with overdue tracking; assignees can update progress on their own actions
+- [x] Email notifications: high/critical alerts to safety managers, action assignment, daily due/overdue digest
+- [x] CSV export of the filtered register (protected against spreadsheet formula injection); print-friendly incident page for PDF via the browser
+- [x] Overview dashboard and Analytics computed from real data; Locations and Settings (people, roles, passwords) pages
+- [x] End-to-end tests run against the real server: full three-role lifecycle, sign-in, visibility rules, mobile reporting
 
 ## Phase 3: Shop-floor reporting
 
@@ -85,8 +88,3 @@ This is a living document. Update it as decisions are made or scope changes.
 
 Inspections and audit checklists, job safety analysis (JSA), training and certification records, management of change, SDS links, public API and webhooks.
 
-## Known prototype gaps (to be resolved in Phase 2)
-
-- The web app still uses in-memory demo data; the API exists but isn't connected yet
-- Dashboard, analytics and location figures are hardcoded
-- Export, Add location, Settings, Resources, search, notifications and workspace switcher are non-functional