feat: implement permissions and actions management

- Add permissions logic for status options in corrective actions.
- Create tests for permissions functionality.
- Implement queries for user authentication and actions management.
- Develop Actions page to display and manage corrective actions.
- Create authentication pages for login, setup, and password reset.
- Add IncidentDetail page to view incident details and associated actions.
- Implement Settings page for user management and password changes.

e2e/incidents.spec.ts

@@ -0,0 +1,44 @@
+import { expect, test } from '@playwright/test'
+import { signIn, unique } from './fixtures'
+
+test('reports from a phone and finds the incident again', async ({ page, isMobile }) => {
+  const title = unique(isMobile ? 'Phone report: oil on floor' : 'Desktop report: oil on floor')
+  await signIn(page, 'reporter')
+  if (isMobile) {
+    await page.getByRole('button', { name: 'Open menu' }).click()
+    await page.getByRole('link', { name: 'Report an incident' }).click()
+  } else {
+    await page.getByRole('link', { name: 'Report incident' }).click()
+  }
+  await page.getByLabel('Incident title').fill(title)
+  await page.getByRole('button', { name: 'Submit report' }).click()
+  await expect(page.getByRole('heading', { level: 1 })).toHaveText(title)
+  const reference = (await page.locator('text=/INC-\\d{4}/').first().textContent())!.match(/INC-\d{4}/)![0]
+
+  await page.goto('/incidents')
+  await page.getByLabel('Search incidents').last().fill(reference)
+  await expect(page.getByRole('link', { name: title })).toBeVisible()
+  await expect(page.getByRole('row')).toHaveCount(2) // header + match
+})
+
+test('filters the register', async ({ page }) => {
+  await signIn(page, 'supervisor')
+  await page.goto('/incidents?status=closed&type=environmental')
+  await expect(page.getByText('No incidents match these filters.')).toBeVisible()
+  await expect(page.getByLabel('Filter by status')).toHaveValue('closed')
+})
+
+test("reporters can't see other people's reports", async ({ page, browser }) => {
+  const title = unique('Supervisor-only report')
+  const supervisor = await (await browser.newContext()).newPage()
+  await signIn(supervisor, 'supervisor')
+  await supervisor.goto('/report')
+  await supervisor.getByLabel('Incident title').fill(title)
+  await supervisor.getByRole('button', { name: 'Submit report' }).click()
+  await expect(supervisor.getByRole('heading', { level: 1 })).toHaveText(title)
+  const url = new URL(supervisor.url()).pathname
+
+  await signIn(page, 'reporter')
+  await page.goto(url)
+  await expect(page.getByText('doesn’t exist or you don’t have access')).toBeVisible()
+})