feat(incidents): add incident management api (#120)

[Cybermaxi7]

Description

Implements CRUD, lifecycle status transitions, ownership assignment, severity/priority updates, audit trail, and filtered/paginated/searchable listing for security incidents, per issue #120.

Adds first-in-repo RBAC guards (JwtAuthGuard/RolesGuard), a PrismaService-backed repository pattern, class-validator DTOs, and Swagger docs at /api/docs, wired globally via main.ts.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Related Issues

CLoses #120

Changes Made

• Added Incident and IncidentAuditLog Prisma models + migration (prisma/schema.prisma, prisma/migrations/20260719120000_add_incidents/)
• Built src/modules/incidents/ per the issue's suggested structure: controllers, services (IncidentsService, IncidentStatusService, IncidentAssignmentService), repository, DTOs, entities, enums, interfaces
• Implemented all 8 suggested endpoints: create, list (paginated/filterable/sortable/searchable), get by id (with audit trail), update, status transition, assign/reassign/remove owner, update severity, update priority, and archive (soft delete)
• Validated lifecycle transitions with a status transition map (new → open → acknowledged → investigating → contained → resolved → closed, plus reopened); invalid/self transitions rejected with a clear error
• Every mutation writes an IncidentAuditLog entry (actor, action, previous/new values, timestamp) and triggers a notification via the existing NotificationsService
• Added first-in-repo shared auth infrastructure: JwtAuthGuard, RolesGuard, @CurrentUser(), @Roles() (src/common/guards, src/common/decorators)
• Added PrismaService/PrismaModule (first repository-pattern usage in the codebase; other modules currently instantiate PrismaClient directly)
• Wired global ValidationPipe and Swagger (/api/docs) into main.ts
• New dependencies: class-validator, class-transformer, @nestjs/swagger, @nestjs/jwt, @nestjs/passport, passport, passport-jwt, @nestjs/platform-express

Testing

• I have tested these changes locally
• Tests pass locally (npm run test)
• Linting passes (npm run lint)
• Code is formatted (npm run format)
• TypeScript builds successfully (npm run build)

Also verified against a real local Postgres instance (mirroring CI's db-migration.yml): prisma migrate deploy applies cleanly on top of the existing init migration, and prisma migrate status reports the schema up to date.

47 new unit tests added covering:

• IncidentsService (create, findAll, findOne, update, updateSeverity/updatePriority, archive)
• IncidentStatusService (valid/invalid/self transitions, resolvedAt/closedAt/reopened timestamp handling)
• IncidentAssignmentService (assign, reassign, remove)
• IncidentsController (delegation to services, guard overrides)
• IncidentsRepository (Prisma query shaping, pagination, soft delete, audit writes)
• DTO validation (class-validator rules on create/update/status/severity/priority/query DTOs)

Run with: npm run test:backend (or npx jest --config jest.backend.config.js apps/backend/src/modules/incidents)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests passed with my changes

Screenshots (if applicable)

N/A — backend API only. Swagger UI is available at /api/docs once the app is running.

Additional Context

This is the first module in the repo to use class-validator DTOs, Swagger, and real JWT/RBAC guards — existing modules (e.g. cases/notes) use a flatter pattern (interfaces instead of DTOs, no guards, raw PrismaClient). Given issue #120's acceptance criteria explicitly calls for RBAC-ready guards and OpenAPI docs, this PR introduces that shared infrastructure under src/common/ rather than duplicating ad hoc auth per-endpoint. Happy to discuss whether other modules should migrate to this pattern in a follow-up.