feat: implement incident reporting and management system

- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents.
- Implement visibility rules for users based on roles (reporters, supervisors).
- Create tests for incident reporting functionality to ensure correctness and reliability.
- Introduce site and area management routes, including validation for area hierarchy.
- Establish user management routes with role-based access control for creating and updating users.
- Add setup routes for initializing the application with an organization and admin user.
- Implement shared enums and schemas for consistent validation and data handling across the application.
- Create a test helper for setting up an in-memory database and API client for testing.
- Add TypeScript configuration for server-side code with strict type checking and module resolution.

server/app.ts

@@ -0,0 +1,45 @@
+import { Hono } from 'hono'
+import { csrf } from 'hono/csrf'
+import { HTTPException } from 'hono/http-exception'
+import { secureHeaders } from 'hono/secure-headers'
+import { loadSession } from './auth/middleware.ts'
+import type { Config } from './config.ts'
+import type { Db } from './db/client.ts'
+import type { AppEnv } from './lib/http.ts'
+import { authRoutes } from './routes/auth.ts'
+import { incidentRoutes } from './routes/incidents.ts'
+import { setupRoutes } from './routes/setup.ts'
+import { areaRoutes, siteRoutes } from './routes/sites.ts'
+import { userRoutes } from './routes/users.ts'
+
+export function createApp({ db, config }: { db: Db; config: Config }) {
+  const app = new Hono<AppEnv>()
+
+  app.use('*', secureHeaders())
+  app.use('/api/*', csrf(), async (c, next) => {
+    c.set('db', db)
+    c.set('config', config)
+    c.header('Cache-Control', 'no-store')
+    await next()
+  })
+  app.use('/api/*', loadSession)
+
+  app.get('/api/health', (c) => c.json({ ok: true }))
+  app.route('/api/setup', setupRoutes)
+  app.route('/api/auth', authRoutes())
+  app.route('/api/users', userRoutes)
+  app.route('/api/sites', siteRoutes)
+  app.route('/api/areas', areaRoutes)
+  app.route('/api/incidents', incidentRoutes)
+  app.all('/api/*', (c) => c.json({ error: 'Not found' }, 404))
+
+  app.onError((error, c) => {
+    if (error instanceof HTTPException) return c.json({ error: error.message }, error.status)
+    console.error(error)
+    return c.json({ error: 'Internal server error' }, 500)
+  })
+
+  return app
+}
+
+export type App = ReturnType<typeof createApp>