feat(incidents): anonymous report tracking by token + public /track

Gap: fileIncident minted a reporter_token and the filing UI showed it
("the only way to look it up later") but there was no lookup UI.

- lib/incident-logic.ts (pure, tested): publicIncidentView redacts —
  board_only updates, subjects, decision-maker ids dropped; disposition
  only surfaced once decided/closed; status label mapping
- trackIncident: public service-client action (token is a 192-bit
  bearer credential on a UNIQUE column; anon has no RLS path so the
  service client is used AFTER token validation; generic not-found is
  enumeration-safe; board_only filtered at the query AND in logic)
- public /track page + client (also accepts ?token= deep link);
  /track added to middleware PUBLIC_ROUTES
- filing UI now deep-links /track?token=<code>
- trackIncidentSchema; __tests__/incident-tracking.test.ts (6)
- docs: API_REFERENCE + HANDOFF pass-20 (session arc, web-verified
  integration facts, locked forward roadmap, open items incl. the
  still-open production incident-INSERT RLS bug)

343 tests; build verified (Compiled successfully, exit 0).

lib/validations.ts

@@ -289,6 +289,13 @@ export const appealIncidentSchema = z.object({
   body: z.string().max(20000).default(''),
 })
 
+// Anonymous reporters look their case up with the opaque token they were
+// given at filing time (48 hex chars today; bound loosely so the format can
+// evolve without breaking old tokens).
+export const trackIncidentSchema = z.object({
+  token: z.string().trim().min(16).max(128),
+})
+
 // ─── Governance: policies ────────────────────────────────────────────────────
 
 export const policyStatuses = ['draft','active','deprecated','superseded'] as const