OSHA Form 300 + certified-payroll exports

Two new export endpoints: /api/export/osha300 (recordable incidents) and /api/export/certified-payroll (Davis-Bacon weekly worker × asset rollup per project).