feat: implement incident reporting and management system

- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents.
- Implement visibility rules for users based on roles (reporters, supervisors).
- Create tests for incident reporting functionality to ensure correctness and reliability.
- Introduce site and area management routes, including validation for area hierarchy.
- Establish user management routes with role-based access control for creating and updating users.
- Add setup routes for initializing the application with an organization and admin user.
- Implement shared enums and schemas for consistent validation and data handling across the application.
- Create a test helper for setting up an in-memory database and API client for testing.
- Add TypeScript configuration for server-side code with strict type checking and module resolution.

README.md

@@ -2,26 +2,45 @@
 
 Free, open-source accident and safety tracking for manufacturing: incident and near-miss reporting, investigations, corrective actions and (planned) OSHA record keeping.
 
-> **Status: early prototype.** The UI runs on in-memory demo data; nothing is saved yet. See [docs/ROADMAP.md](docs/ROADMAP.md) for the plan and [docs/TODO.md](docs/TODO.md) for open items.
+> **Status: early development.** The API and database are in place; the web app still shows demo data until it is connected in Phase 2. See [docs/ROADMAP.md](docs/ROADMAP.md) for the plan and [docs/TODO.md](docs/TODO.md) for open items.
 
 ## Getting started
 
-Requires Node.js 22.12 or later (see `.nvmrc`).
+Requires Node.js 22.18 or later (see `.nvmrc`). No database install is needed for development: the server uses embedded PostgreSQL (PGlite) stored in `./data/`.
 
 ```sh
 npm install
-npm run dev
+npm run db:seed   # optional: demo organization, sites, users and incidents
+npm run dev       # web app on http://localhost:5173, API on http://localhost:3000
 ```
 
+Demo users (after seeding): `admin@example.com`, `manager@example.com`, `supervisor@example.com` and `reporter@example.com`, all with password `safetylog-demo`. Without seeding, call `POST /api/setup` to create your organization and first admin (see [docs/API.md](docs/API.md)).
+
+Settings are read from environment variables or a `.env` file; see [.env.example](.env.example).
+
+## Running in production
+
+```sh
+cp .env.example .env    # set POSTGRES_PASSWORD, and PUBLIC_URL if not localhost
+docker compose up -d --build
+```
+
+This runs the app and PostgreSQL. The app applies database migrations on startup and serves the web app and API on port 3000. Use HTTPS (for example behind a reverse proxy) and set `PUBLIC_URL` to the `https://` address so session cookies are marked secure.
+
+For a very small single-machine install, the app image also runs on its own with embedded PostgreSQL: `docker run -p 3000:3000 -v safetylog-data:/app/data <image>`.
+
 ## Scripts
 
 | Command | What it does |
 | --- | --- |
-| `npm run dev` | Start the dev server |
+| `npm run dev` | Start the web app and API together with auto-reload |
+| `npm start` | Start the API server (serves `dist/` too when built) |
 | `npm run build` | Production build to `dist/` |
 | `npm run lint` | Lint with Oxlint (warnings fail) |
 | `npm run typecheck` | Type-check with TypeScript |
-| `npm test` | Unit and component tests (Vitest) |
+| `npm test` | Web and server tests (Vitest; server tests use an in-memory database) |
+| `npm run db:generate` | Create a migration after changing `server/db/schema.ts` |
+| `npm run db:seed` | Load demo data into an empty database |
 | `npm run test:e2e` | End-to-end tests (Playwright, desktop and mobile). Run `npx playwright install chromium` once first |
 | `npm run check` | Lint, typecheck, test and build in one go |
 
@@ -30,13 +49,18 @@ CI runs the same checks on every push and pull request (`.gitea/workflows/ci.yml
 ## Project layout
 
 ```
-src/
+src/            Web app (React)
   pages/        One component per route
   components/   Shared UI (layout, tables, form pieces) and shared class strings in styles.ts
   lib/          Types, domain logic, demo data; no React components
   index.css     Tailwind import and design tokens (@theme)
+server/         API (Hono on Node)
+  routes/       One file per resource, with its tests alongside
+  auth/         Passwords, sessions, permissions
+  db/           Drizzle schema, migrations, seed script
+shared/         Enums and validation schemas used by both
 e2e/            Playwright tests
-docs/           Roadmap and design notes
+docs/           Roadmap, to-do list, API reference
 ```
 
 Styling is Tailwind CSS v4. Colors, fonts and small text sizes are defined as theme tokens in `src/index.css`. Fonts are bundled through Fontsource, so the app makes no third-party requests and works on isolated plant networks.