feat(incidents): anonymous report tracking by token + public /track

Gap: fileIncident minted a reporter_token and the filing UI showed it
("the only way to look it up later") but there was no lookup UI.

- lib/incident-logic.ts (pure, tested): publicIncidentView redacts —
  board_only updates, subjects, decision-maker ids dropped; disposition
  only surfaced once decided/closed; status label mapping
- trackIncident: public service-client action (token is a 192-bit
  bearer credential on a UNIQUE column; anon has no RLS path so the
  service client is used AFTER token validation; generic not-found is
  enumeration-safe; board_only filtered at the query AND in logic)
- public /track page + client (also accepts ?token= deep link);
  /track added to middleware PUBLIC_ROUTES
- filing UI now deep-links /track?token=<code>
- trackIncidentSchema; __tests__/incident-tracking.test.ts (6)
- docs: API_REFERENCE + HANDOFF pass-20 (session arc, web-verified
  integration facts, locked forward roadmap, open items incl. the
  still-open production incident-INSERT RLS bug)

343 tests; build verified (Compiled successfully, exit 0).

lib/actions/incidents.ts

@@ -2,6 +2,7 @@
 
 import { revalidatePath } from 'next/cache'
 import { createClient } from '@/lib/supabase/server'
+import { createAdminClient } from '@/lib/supabase/admin'
 import {
   requireMember,
   requireMemberWithRole,
@@ -14,7 +15,9 @@ import {
   updateIncidentStatusSchema,
   addIncidentUpdateSchema,
   appealIncidentSchema,
+  trackIncidentSchema,
 } from '@/lib/validations'
+import { publicIncidentView } from '@/lib/incident-logic'
 
 /**
  * Generate a short opaque tracking token for anonymous reports.
@@ -254,3 +257,38 @@ export async function appealIncident(formData: {
   revalidatePath(`/proposals/${proposal.id}`)
   return { data: proposal }
 }
+
+/**
+ * Public, unauthenticated lookup of an anonymously-filed incident by its
+ * opaque reporter token. No session: the token IS the bearer credential, so
+ * this uses the service client (anon has no RLS path to incidents) AFTER
+ * validating the token, exactly like the forms public read. The returned
+ * projection is redacted by `publicIncidentView` — board-only updates,
+ * subjects, decision-maker ids and an undecided disposition never leave the
+ * server. The token is 192 bits of randomness on a UNIQUE column, so a
+ * generic not-found response is safe against enumeration.
+ */
+export async function trackIncident(input: unknown) {
+  const v = parseInput(trackIncidentSchema, input)
+  if (!v.ok) return { error: v.error }
+
+  const admin = createAdminClient()
+  const { data: incident } = await admin
+    .from('incidents')
+    .select(
+      'id, title, body, category, severity, status, disposition, created_at, acknowledged_at, decided_at, closed_at',
+    )
+    .eq('reporter_token', v.data.token)
+    .maybeSingle()
+
+  if (!incident) return { error: 'No report matches that tracking code.' }
+
+  const { data: updates } = await admin
+    .from('incident_updates')
+    .select('body, author_name, visibility, created_at')
+    .eq('incident_id', incident.id)
+    .neq('visibility', 'board_only')
+    .order('created_at', { ascending: true })
+
+  return { data: publicIncidentView(incident, updates ?? []) }
+}