feat(cli,api): incident CRUD — create/update/resolve with Markdown body

[amondnet]

Context / Motivation

There is currently no management path for incidents at all. The D1 schema (apps/worker/schema.sql:20-35) and the timeline UI (apps/web/src/components/IncidentList.tsx) exist, but nothing lets an operator declare an incident, post an update, or resolve it. #61 makes ingest write incidents automatically; this issue adds the human-driven half of the lifecycle, which is what operators actually use during an outage.

The content workflow from emdash-cms/emdash is a good model for the shape of this API:

• Draft vs. published states, so an incident can be prepared before it goes public.
• Revision-safe updates via optimistic concurrency (a _rev-style read-before-write) so two operators editing the same incident during an outage cannot silently clobber each other.
• A Markdown body converted into structured update entries rather than a free-form blob.

Proposed scope

• Authenticated Worker API endpoints: create incident, update incident, resolve incident, and post an update entry to an existing incident.
• Optimistic concurrency on update/resolve — a stale revision is rejected rather than applied.
• Draft/published state, so an unpublished incident does not appear on the public page or in feeds.
• statusbeam incident create | update | resolve commands in packages/cli, driving those endpoints.
• Incident updates render in the existing lifecycle timeline and in the RSS/Atom feeds.

Acceptance criteria

• An operator can run the full incident lifecycle (create → update → resolve) from the CLI against a deployed Worker.
• The status page timeline and the RSS/Atom feeds reflect each step.
• A draft incident is not visible on the public page or in feeds until published.
• A write against a stale revision is rejected with a clear error.
• Unauthenticated requests to the write endpoints are rejected.

Priority / Effort / Dependencies

• Priority: p1
• Effort: L (~1 week)
• Dependencies: none. Blocks the incident admin panel / MCP surface and email subscriber notifications.