Implement /api/report and /api/followup with Gemini

[williamchiii]

Two POST endpoints are scaffolded and return 501. Replace the POST bodies with Gemini calls. Contracts are documented in the file headers. Don't change the request/response shapes. Tasks are labeled with TODO

Files:

• src/app/api/report/route.js
• src/app/api/followup/route.js

Rules:

• Use process.env.GEMINI_API_KEY (server-only).
• Use jsonOk / jsonError from src/lib/http.js so responses stay consistent.
• On Gemini failure, return 502 — don't crash.

Done when:

• Both endpoints return real data on a valid request
• Errors return { ok: false, errors: [...] }
• npm test still passes