feat: add incident triage filters and visible-report CSV export

[pralav-25]

Search incident reports by asset, ID, description, or resolution note, combine status and observed-priority filters, and sort by newest, oldest, or highest priority. The result count updates without replacing the focused search input, and Clear filters restores all history.

Export visible CSV downloads exactly the filtered reports in their displayed order. Cells are quoted and leading formula characters are escaped; the export contains report details and photo-presence flags while excluding tracking tokens and image bytes. Export is disabled for an empty result, and search state clears on sign-out.

Validation:

• node --test tests-web/*.test.mjs — 8 tests pass, including combined filters, sort order, non-mutation, CSV escaping, and excluded tokens/photo data.
• node --check public/static/app.js, ruff check ., and python -m unittest discover -s tests -v — pass (27 API/scoring/schema tests on local SQLite).
• Chromium at 1440×1000 and 390×844 with a local private demo and actual API-created reports: filters, sorting, empty state, disabled export, downloaded CSV contents, clear-filter focus, and report details.
• No horizontal page overflow or uncaught browser errors. Repository CI also runs the API suite with PostgreSQL.