feat: implement incident reporting and management system

- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents.
- Implement visibility rules for users based on roles (reporters, supervisors).
- Create tests for incident reporting functionality to ensure correctness and reliability.
- Introduce site and area management routes, including validation for area hierarchy.
- Establish user management routes with role-based access control for creating and updating users.
- Add setup routes for initializing the application with an organization and admin user.
- Implement shared enums and schemas for consistent validation and data handling across the application.
- Create a test helper for setting up an in-memory database and API client for testing.
- Add TypeScript configuration for server-side code with strict type checking and module resolution.

server/auth/password.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest'
+import { hashPassword, verifyPassword } from './password.ts'
+
+describe('password hashing', () => {
+  it('verifies the right password and rejects the wrong one', async () => {
+    const hash = await hashPassword('correct horse battery')
+    expect(hash).toMatch(/^scrypt\$32768\$8\$3\$/)
+    expect(await verifyPassword('correct horse battery', hash)).toBe(true)
+    expect(await verifyPassword('wrong horse battery', hash)).toBe(false)
+  })
+
+  it('salts each hash', async () => {
+    expect(await hashPassword('same password')).not.toBe(await hashPassword('same password'))
+  })
+
+  it('rejects malformed hashes', async () => {
+    expect(await verifyPassword('anything', 'not-a-hash')).toBe(false)
+  })
+})