Let planned changes be taken back and corrected too

Deleting and correcting a history entry stopped at the present: anything
not yet effective stayed put. That was not a principle, it was a missing
link. A planned change lives as a payload in pending_org_changes, and
nothing tied it to the history row — only a person and a date, and the
data already holds an Eintritt and a Vertragsänderung sharing one. So
employee_history now carries pending_id, set by change_employee_data
when it schedules something.

One planned change can carry two history rows: Stammdaten and Vertrag
are kept apart but scheduled together. Taking one back therefore strips
only that group's fields from the payload, and cancels the operation
only when nothing is left. Correcting one rewrites its group and the
effective date, and touches no employee data — the change has not
happened yet.

An entry stays on its side of the present. Pulling a planned change into
today, or pushing an effective one into the future, would mean adjusting
the employee record and the pending payload in opposite directions;
that is what the real operations are for.

Existing rows were linked where exactly one running operation matched
the person and date and no other row had claimed it. All five of them
matched. Anything ambiguous would have kept the old refusal, which now
says the actual reason.

The edit dialog surfaced a bug in useDialogFocus that predates it: the
effect depended on the identity of onClose, which almost every caller
rebuilds on render, so it re-ran after each keystroke and its cleanup
pulled focus back to whatever opened the dialog. Any dialog with a text
field would have accepted one character. It never showed because until
now no dialog kept its own state next to its own onClose.

Rehearsed against real data: a two-row planned change corrected, one row
taken back with the operation continuing on the rest, the second taken
back with the operation cancelled, and both refusals.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/components/dialog-a11y.test.tsx

@@ -25,7 +25,33 @@ function ModalHarness({ onClose = () => {} }: { onClose?: () => void }) {
   );
 }
 
+// Ein Dialog, dessen onClose bei jedem Rendern neu entsteht — und dessen
+// Zustand im selben Bauteil liegt, sodass jeder Tastendruck neu rendert. Das
+// ist der Normalfall für ein Formular im Dialog.
+function DialogMitEigenemZustand() {
+  const [offen, setOffen] = useState(true);
+  const [wert, setWert] = useState("");
+  if (!offen) return <p>zu</p>;
+  return (
+    <Modal open onClose={() => setOffen(false)} title="Tippen" footer={<Button>Speichern</Button>}>
+      <TextField label="Feld" value={wert} onChange={setWert} />
+    </Modal>
+  );
+}
+
 describe("Modal focus management", () => {
+  it("lässt mehr als ein Zeichen tippen", async () => {
+    // Der Fokus-Wächter hing an der Identität von onClose. Die entsteht bei
+    // fast jedem Aufrufer bei jedem Rendern neu, also lief der Effekt nach
+    // jedem Tastendruck erneut — und sein Aufräumen holte den Fokus dorthin
+    // zurück, wo er vor dem Öffnen war. Nach dem ersten Zeichen ging die
+    // Eingabe ins Leere.
+    render(<DialogMitEigenemZustand />);
+    const feld = screen.getByLabelText("Feld");
+    await userEvent.type(feld, "Bahnhofstrasse");
+    expect(feld).toHaveValue("Bahnhofstrasse");
+  });
+
   it("names the dialog from its visible heading", () => {
     render(<ModalHarness />);
     expect(screen.getByRole("dialog", { name: "Testdialog" })).toBeInTheDocument();