feat(incidents): anonymous report tracking by token + public /track

Gap: fileIncident minted a reporter_token and the filing UI showed it
("the only way to look it up later") but there was no lookup UI.

- lib/incident-logic.ts (pure, tested): publicIncidentView redacts —
  board_only updates, subjects, decision-maker ids dropped; disposition
  only surfaced once decided/closed; status label mapping
- trackIncident: public service-client action (token is a 192-bit
  bearer credential on a UNIQUE column; anon has no RLS path so the
  service client is used AFTER token validation; generic not-found is
  enumeration-safe; board_only filtered at the query AND in logic)
- public /track page + client (also accepts ?token= deep link);
  /track added to middleware PUBLIC_ROUTES
- filing UI now deep-links /track?token=<code>
- trackIncidentSchema; __tests__/incident-tracking.test.ts (6)
- docs: API_REFERENCE + HANDOFF pass-20 (session arc, web-verified
  integration facts, locked forward roadmap, open items incl. the
  still-open production incident-INSERT RLS bug)

343 tests; build verified (Compiled successfully, exit 0).

app/track/page.tsx

@@ -0,0 +1,26 @@
+import { TrackClient } from './track-client'
+
+export const dynamic = 'force-dynamic'
+
+// Public, unauthenticated. An anonymous incident reporter pastes the tracking
+// token they were given at filing time to see their report's status and the
+// official updates meant for them. /track is in middleware PUBLIC_ROUTES.
+export default async function TrackPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ token?: string }>
+}) {
+  const { token } = await searchParams
+  return (
+    <main className="mx-auto max-w-xl p-4 md:p-10">
+      <h1 className="text-2xl font-semibold">Track a report</h1>
+      <p className="mt-2 text-sm text-muted-foreground">
+        Enter the tracking code you were given when you filed an anonymous report. It is the
+        only way to look the report up — we cannot recover it for you.
+      </p>
+      <div className="mt-6">
+        <TrackClient initialToken={token ?? ''} autoSubmit={Boolean(token)} />
+      </div>
+    </main>
+  )
+}