feat(incidents): anonymous report tracking by token + public /track

Gap: fileIncident minted a reporter_token and the filing UI showed it
("the only way to look it up later") but there was no lookup UI.

- lib/incident-logic.ts (pure, tested): publicIncidentView redacts —
  board_only updates, subjects, decision-maker ids dropped; disposition
  only surfaced once decided/closed; status label mapping
- trackIncident: public service-client action (token is a 192-bit
  bearer credential on a UNIQUE column; anon has no RLS path so the
  service client is used AFTER token validation; generic not-found is
  enumeration-safe; board_only filtered at the query AND in logic)
- public /track page + client (also accepts ?token= deep link);
  /track added to middleware PUBLIC_ROUTES
- filing UI now deep-links /track?token=<code>
- trackIncidentSchema; __tests__/incident-tracking.test.ts (6)
- docs: API_REFERENCE + HANDOFF pass-20 (session arc, web-verified
  integration facts, locked forward roadmap, open items incl. the
  still-open production incident-INSERT RLS bug)

343 tests; build verified (Compiled successfully, exit 0).

app/(app)/incidents/new/incident-form.tsx

@@ -66,6 +66,13 @@ export function IncidentForm({ members }: { members: Member[] }) {
           or display it elsewhere.
         </p>
         <pre className="bg-background border border-border rounded p-3 font-mono text-sm break-all">{token}</pre>
+        <p className="font-sans text-sm text-muted-foreground">
+          Check the status any time at{' '}
+          <Link href={`/track?token=${encodeURIComponent(token)}`} className="text-primary underline">
+            /track
+          </Link>{' '}
+          with this code. Bookmark it now.
+        </p>
         <Link
           href="/incidents"
           className="inline-block bg-primary text-white font-sans text-sm font-medium px-4 py-2 rounded hover:bg-primary/90 transition"