feat: implement incident reporting and management system

- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents.
- Implement visibility rules for users based on roles (reporters, supervisors).
- Create tests for incident reporting functionality to ensure correctness and reliability.
- Introduce site and area management routes, including validation for area hierarchy.
- Establish user management routes with role-based access control for creating and updating users.
- Add setup routes for initializing the application with an organization and admin user.
- Implement shared enums and schemas for consistent validation and data handling across the application.
- Create a test helper for setting up an in-memory database and API client for testing.
- Add TypeScript configuration for server-side code with strict type checking and module resolution.

docs/ROADMAP.md

@@ -10,8 +10,10 @@ This is a living document. Update it as decisions are made or scope changes.
 | --- | --- | --- |
 | License | AGPL-3.0-only | Decided |
 | Frontend | React + Vite + TypeScript, Tailwind CSS v4 | Decided |
-| Backend | Node (Fastify or Hono) + PostgreSQL + Drizzle ORM, shared Zod schemas | Proposed |
-| Deployment | Self-hosted, single `docker compose up` (app + Postgres + file storage) | Proposed |
+| Backend | Node + Hono, PostgreSQL via Drizzle ORM, Zod schemas shared with the web app (`shared/`). Node runs the TypeScript directly (no build step for the server) | Decided |
+| Database | PostgreSQL in production; embedded PGlite for local development, tests and very small installs | Decided |
+| Auth | Email + password (scrypt), server-side sessions in an http-only cookie, four roles: reporter < supervisor < safety manager < admin | Decided |
+| Deployment | Self-hosted, single `docker compose up` (app + Postgres); file storage added with photo upload | Decided |
 | Compliance scope | US OSHA first; data model kept extensible for other regions (e.g. RIDDOR) | Proposed |
 | CI | Gitea Actions (`.gitea/workflows`): lint, typecheck, unit tests, build, e2e | Decided |
 | Product name | Open SafetyLog EHS (replaced placeholder "IA Tracker" and the prototype's "Safesite" branding) | Decided |
@@ -32,13 +34,21 @@ This is a living document. Update it as decisions are made or scope changes.
 
 ## Phase 1: Backend and data model
 
-- Entities: Organization, Site → Area (location tree), User, Role, Incident (type, severity, status, timestamps, reporter or anonymous), InjuredPerson and injury details, Attachment, Investigation, RootCause, CorrectiveAction, Comment, AuditLog, HoursWorked
-- Auth: email/password and magic links; SSO/OIDC later; role-based permissions
-- REST API with pagination, filtering and sequential incident numbering
+- [x] Database schema and first migration for all entities: Organization, Site → Area (location tree), User, Session, Incident, InjuredPerson, Attachment, Investigation, RootCause, CorrectiveAction, Comment, AuditLog, HoursWorked
+- [x] First-run setup (creates the organization and first admin)
+- [x] Email/password sign-in, sessions, change password, login rate limiting
+- [x] Role-based permissions (reporters see only their own reports)
+- [x] REST API: users, sites/areas, incidents with pagination, search, filters and gap-free sequential numbers (`INC-0001`); see [API.md](API.md)
+- [x] Audit log of every change
+- [x] Server tests (Vitest + in-memory PostgreSQL), demo seed data
+- [x] Dockerfile and `docker-compose.yml`
+- Moved to Phase 2: magic-link sign-in and password reset by email (both need the email sending built for notifications). SSO/OIDC stays "later".
 
 ## Phase 2: Core workflow (MVP)
 
-- Reporting that saves to the database, with photo upload
+- Connect the web app to the API: sign-in and first-run setup screens, incident list and report form using real data
+- Photo upload (attachments)
+- Magic-link sign-in and password reset by email
 - Incident detail page: timeline, investigation, root-cause tools (5 Whys, fishbone), corrective actions (CAPA)
 - Status workflow: Reported → Triage → Investigation → Corrective actions → Verification → Closed, with role-based transitions
 - "My actions" list and overdue tracking
@@ -75,8 +85,8 @@ This is a living document. Update it as decisions are made or scope changes.
 
 Inspections and audit checklists, job safety analysis (JSA), training and certification records, management of change, SDS links, public API and webhooks.
 
-## Known prototype gaps (to be resolved in Phases 1–2)
+## Known prototype gaps (to be resolved in Phase 2)
 
-- All data is in memory and resets on refresh
+- The web app still uses in-memory demo data; the API exists but isn't connected yet
 - Dashboard, analytics and location figures are hardcoded
 - Export, Add location, Settings, Resources, search, notifications and workspace switcher are non-functional