Phase 2/3: Employees list/detail + mutation RPCs + action panels

- supabase/functions.sql, functions_2.sql: Postgres RPCs for every
  employee/position/reorg mutation (hire, terminate, transfer, promote,
  start/adjust/return karenz, change data, rehire, create position, staff
  internally, apply/undo reorg). Each resolves manager_id server-side,
  writes history + audit atomically, and enforces hr_admin via
  require_hr_admin() (backed by the existing RLS policy).
- actions/employees.ts, positions.ts, reorg.ts: Server Actions wrapping
  the RPCs, returning success/error for client-side toast handling.
- Employees list (search/filter/pagination) and detail (4 tabs: Stammdaten,
  Vertrag & Gehalt, Organisation, Historie) reading from employees_directory.
- 6 action slide-over panels: Transfer, Promote, Karenz (start/adjust/
  return), Daten aendern (person+contract diffing), Terminate (with direct-
  report reparenting warning + offboarding checklist), Rehire.
- lib/org.ts: shared division/department/team/location lookups.

Verified live: promote mutation updates salary, writes history/audit, and
the detail page reflects it after refresh, no console errors.

Note: the spec's Karenz-verwalten panel only covers employees already on
Karenz; added a start-Karenz mode (Karenzbeginn/geplante Rueckkehr) to
cover the Aktiv-employee case implied by the header button but not
specified in the panel list.

actions/employees.ts

@@ -0,0 +1,111 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { createClient } from "@/lib/supabase/server";
+import type { Database } from "@/lib/supabase/types";
+
+type ActionResult = { success: boolean; error?: string };
+type MutationFn = keyof Database["public"]["Functions"];
+
+async function callRpc(fn: MutationFn, payload: Record<string, unknown>, revalidate: string[]): Promise<ActionResult> {
+  const supabase = await createClient();
+  const { error } = await supabase.rpc(fn, { payload });
+  if (error) return { success: false, error: error.message };
+  for (const path of revalidate) revalidatePath(path);
+  return { success: true };
+}
+
+export async function hireEmployee(payload: {
+  first_name: string;
+  last_name: string;
+  gender: "m" | "w";
+  birth_date: string;
+  sv_nummer?: string;
+  phone?: string;
+  position_id?: string;
+  team_id?: string;
+  job_title?: string;
+  location_id: string;
+  entry_date: string;
+  contract_type?: "unbefristet" | "befristet";
+  contract_end_date?: string;
+  employment_type?: "Vollzeit" | "Teilzeit";
+  weekly_hours?: number;
+  monthly_salary_gross: number;
+  paygrade?: "A" | "B" | "C" | "D" | "E" | "F";
+  source: "Intern" | "Extern";
+}): Promise<ActionResult & { employeeId?: string }> {
+  const supabase = await createClient();
+  const { data, error } = await supabase.rpc("hire_employee", { payload });
+  if (error) return { success: false, error: error.message };
+  revalidatePath("/employees");
+  revalidatePath("/");
+  revalidatePath("/positions");
+  return { success: true, employeeId: data as string };
+}
+
+export async function terminateEmployee(payload: {
+  employee_id: string;
+  exit_date: string;
+  exit_reason: string;
+  note?: string;
+}): Promise<ActionResult> {
+  return callRpc("terminate_employee", payload, [`/employees/${payload.employee_id}`, "/employees", "/"]);
+}
+
+export async function transferEmployee(payload: {
+  employee_id: string;
+  effective_date: string;
+  new_team_id: string;
+  new_title?: string;
+}): Promise<ActionResult> {
+  return callRpc("transfer_employee", payload, [`/employees/${payload.employee_id}`, "/employees"]);
+}
+
+export async function promoteEmployee(payload: {
+  employee_id: string;
+  effective_date: string;
+  new_title: string;
+  new_salary: number;
+  new_paygrade?: "A" | "B" | "C" | "D" | "E" | "F";
+}): Promise<ActionResult> {
+  return callRpc("promote_employee", payload, [`/employees/${payload.employee_id}`, "/employees"]);
+}
+
+export async function startKarenz(payload: {
+  employee_id: string;
+  karenz_start_date: string;
+  planned_return_date: string;
+  note?: string;
+}): Promise<ActionResult> {
+  return callRpc("start_karenz", payload, [`/employees/${payload.employee_id}`, "/employees", "/"]);
+}
+
+export async function adjustKarenzReturn(payload: {
+  employee_id: string;
+  new_return_date: string;
+  note?: string;
+}): Promise<ActionResult> {
+  return callRpc("adjust_karenz_return", payload, [`/employees/${payload.employee_id}`]);
+}
+
+export async function recordKarenzReturn(payload: {
+  employee_id: string;
+  return_date: string;
+  employment_mode: "unverändert" | "Vollzeit" | "Teilzeit";
+  weekly_hours?: number;
+}): Promise<ActionResult> {
+  return callRpc("record_karenz_return", payload, [`/employees/${payload.employee_id}`, "/employees", "/"]);
+}
+
+export async function changeEmployeeData(payload: {
+  employee_id: string;
+  person: Record<string, unknown>;
+  contract: Record<string, unknown>;
+}): Promise<ActionResult> {
+  return callRpc("change_employee_data", payload, [`/employees/${payload.employee_id}`, "/employees"]);
+}
+
+export async function rehireEmployee(payload: { employee_id: string; rehire_date: string }): Promise<ActionResult> {
+  return callRpc("rehire_employee", payload, [`/employees/${payload.employee_id}`, "/employees", "/"]);
+}