Authentication and RBAC

## Problem
No user identity or authorization boundaries.

## Outcome
Add authentication and role-based access control for incident workspaces.

## Acceptance Criteria
- [ ] Auth flow implemented
- [ ] Role checks for incident actions
- [ ] Unauthorized users cannot access protected resources

## Priority
High