refactor(admin): split 9 more oversized lib/ files into focused modules

Files split by agents before rate limit:
  - dsr/api.ts (669 → barrel + helpers)
  - einwilligungen/context.tsx (669 → barrel + hooks/reducer)
  - export.ts (753 → barrel + domain exporters)
  - incidents/api.ts (845 → barrel + api-helpers)
  - tom-generator/context.tsx (720 → barrel + hooks/reducer)
  - vendor-compliance/context.tsx (1010 → 234 provider + hooks/reducer)
  - api-docs/endpoints.ts — partially split (3 domain files created)
  - academy/api.ts — partially split (helpers extracted)
  - whistleblower/api.ts — partially split (helpers extracted)

next build passes. api-client.ts (885) deferred to next session.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

admin-compliance/lib/sdk/incidents/api-helpers.ts

@@ -0,0 +1,83 @@
+/**
+ * Incident API - Shared configuration and helper functions
+ */
+
+// =============================================================================
+// CONFIGURATION
+// =============================================================================
+
+export const INCIDENTS_API_BASE = process.env.NEXT_PUBLIC_SDK_API_URL || 'http://localhost:8093'
+export const API_TIMEOUT = 30000 // 30 seconds
+
+// =============================================================================
+// HELPER FUNCTIONS
+// =============================================================================
+
+export function getTenantId(): string {
+  if (typeof window !== 'undefined') {
+    return localStorage.getItem('bp_tenant_id') || 'default-tenant'
+  }
+  return 'default-tenant'
+}
+
+export function getAuthHeaders(): HeadersInit {
+  const headers: HeadersInit = {
+    'Content-Type': 'application/json',
+    'X-Tenant-ID': getTenantId()
+  }
+
+  if (typeof window !== 'undefined') {
+    const token = localStorage.getItem('authToken')
+    if (token) {
+      headers['Authorization'] = `Bearer ${token}`
+    }
+    const userId = localStorage.getItem('bp_user_id')
+    if (userId) {
+      headers['X-User-ID'] = userId
+    }
+  }
+
+  return headers
+}
+
+export async function fetchWithTimeout<T>(
+  url: string,
+  options: RequestInit = {},
+  timeout: number = API_TIMEOUT
+): Promise<T> {
+  const controller = new AbortController()
+  const timeoutId = setTimeout(() => controller.abort(), timeout)
+
+  try {
+    const response = await fetch(url, {
+      ...options,
+      signal: controller.signal,
+      headers: {
+        ...getAuthHeaders(),
+        ...options.headers
+      }
+    })
+
+    if (!response.ok) {
+      const errorBody = await response.text()
+      let errorMessage = `HTTP ${response.status}: ${response.statusText}`
+      try {
+        const errorJson = JSON.parse(errorBody)
+        errorMessage = errorJson.error || errorJson.message || errorMessage
+      } catch {
+        // Keep the HTTP status message
+      }
+      throw new Error(errorMessage)
+    }
+
+    // Handle empty responses
+    const contentType = response.headers.get('content-type')
+    if (contentType && contentType.includes('application/json')) {
+      return response.json()
+    }
+
+    return {} as T
+  } finally {
+    clearTimeout(timeoutId)
+  }
+}