feat(incidents): anonymous report tracking by token + public /track

Gap: fileIncident minted a reporter_token and the filing UI showed it
("the only way to look it up later") but there was no lookup UI.

- lib/incident-logic.ts (pure, tested): publicIncidentView redacts —
  board_only updates, subjects, decision-maker ids dropped; disposition
  only surfaced once decided/closed; status label mapping
- trackIncident: public service-client action (token is a 192-bit
  bearer credential on a UNIQUE column; anon has no RLS path so the
  service client is used AFTER token validation; generic not-found is
  enumeration-safe; board_only filtered at the query AND in logic)
- public /track page + client (also accepts ?token= deep link);
  /track added to middleware PUBLIC_ROUTES
- filing UI now deep-links /track?token=<code>
- trackIncidentSchema; __tests__/incident-tracking.test.ts (6)
- docs: API_REFERENCE + HANDOFF pass-20 (session arc, web-verified
  integration facts, locked forward roadmap, open items incl. the
  still-open production incident-INSERT RLS bug)

343 tests; build verified (Compiled successfully, exit 0).

__tests__/incident-tracking.test.ts

@@ -0,0 +1,96 @@
+import { describe, it, expect } from 'vitest'
+import {
+  publicIncidentView,
+  visibleUpdate,
+  INCIDENT_STATUS_LABELS,
+  type RawIncident,
+  type RawUpdate,
+} from '@/lib/incident-logic'
+import { trackIncidentSchema } from '@/lib/validations'
+
+const baseIncident: RawIncident = {
+  title: 'Unsafe saw guard',
+  body: 'The table saw guard is missing.',
+  category: 'safety',
+  severity: 'high',
+  status: 'received',
+  disposition: 'Removed member X for 30 days',
+  created_at: '2026-05-17T00:00:00Z',
+  acknowledged_at: null,
+  decided_at: null,
+  closed_at: null,
+}
+
+const updates: RawUpdate[] = [
+  { body: 'We are looking into this.', author_name: 'Board', visibility: 'all_parties', created_at: '2026-05-17T01:00:00Z' },
+  { body: 'Internal: contact insurer.', author_name: 'Chair', visibility: 'board_only', created_at: '2026-05-17T02:00:00Z' },
+  { body: 'A note just for you.', author_name: null, visibility: 'reporter_only', created_at: '2026-05-17T03:00:00Z' },
+]
+
+describe('visibleUpdate', () => {
+  it('allows reporter_only and all_parties, denies board_only and unknown', () => {
+    expect(visibleUpdate('reporter_only')).toBe(true)
+    expect(visibleUpdate('all_parties')).toBe(true)
+    expect(visibleUpdate('board_only')).toBe(false)
+    expect(visibleUpdate('something_else')).toBe(false)
+  })
+})
+
+describe('publicIncidentView redaction', () => {
+  it('drops board_only updates and keeps the rest, defaulting author', () => {
+    const v = publicIncidentView(baseIncident, updates)
+    expect(v.updates).toHaveLength(2)
+    expect(v.updates.some(u => u.body.includes('Internal'))).toBe(false)
+    const reporterNote = v.updates.find(u => u.body === 'A note just for you.')
+    expect(reporterNote?.author).toBe('Space team')
+  })
+
+  it('hides disposition until a decision is reached', () => {
+    expect(publicIncidentView(baseIncident, []).disposition).toBeNull()
+    expect(publicIncidentView({ ...baseIncident, status: 'under_review' }, []).disposition).toBeNull()
+    expect(publicIncidentView({ ...baseIncident, status: 'decided' }, []).disposition).toBe(
+      'Removed member X for 30 days',
+    )
+    expect(publicIncidentView({ ...baseIncident, status: 'closed' }, []).disposition).toBe(
+      'Removed member X for 30 days',
+    )
+  })
+
+  it('exposes only the safe projection keys (no subjects/decision makers/ids)', () => {
+    const v = publicIncidentView(baseIncident, [])
+    expect(Object.keys(v).sort()).toEqual(
+      [
+        'acknowledgedAt',
+        'body',
+        'category',
+        'closedAt',
+        'createdAt',
+        'decidedAt',
+        'disposition',
+        'severity',
+        'status',
+        'statusLabel',
+        'title',
+        'updates',
+      ].sort(),
+    )
+  })
+
+  it('maps status to a human label', () => {
+    expect(publicIncidentView({ ...baseIncident, status: 'under_review' }, []).statusLabel).toBe(
+      INCIDENT_STATUS_LABELS.under_review,
+    )
+    // Unknown status falls back to the raw value.
+    expect(publicIncidentView({ ...baseIncident, status: 'weird' }, []).statusLabel).toBe('weird')
+  })
+})
+
+describe('trackIncidentSchema', () => {
+  it('trims and bounds the token', () => {
+    expect(trackIncidentSchema.safeParse({ token: '  ' + 'a'.repeat(20) + '  ' }).success).toBe(true)
+    expect(trackIncidentSchema.safeParse({ token: 'short' }).success).toBe(false)
+    expect(trackIncidentSchema.safeParse({ token: '' }).success).toBe(false)
+    expect(trackIncidentSchema.safeParse({ token: 'a'.repeat(129) }).success).toBe(false)
+    expect(trackIncidentSchema.safeParse({}).success).toBe(false)
+  })
+})