Phase 2/3: Employees list/detail + mutation RPCs + action panels

- supabase/functions.sql, functions_2.sql: Postgres RPCs for every
  employee/position/reorg mutation (hire, terminate, transfer, promote,
  start/adjust/return karenz, change data, rehire, create position, staff
  internally, apply/undo reorg). Each resolves manager_id server-side,
  writes history + audit atomically, and enforces hr_admin via
  require_hr_admin() (backed by the existing RLS policy).
- actions/employees.ts, positions.ts, reorg.ts: Server Actions wrapping
  the RPCs, returning success/error for client-side toast handling.
- Employees list (search/filter/pagination) and detail (4 tabs: Stammdaten,
  Vertrag & Gehalt, Organisation, Historie) reading from employees_directory.
- 6 action slide-over panels: Transfer, Promote, Karenz (start/adjust/
  return), Daten aendern (person+contract diffing), Terminate (with direct-
  report reparenting warning + offboarding checklist), Rehire.
- lib/org.ts: shared division/department/team/location lookups.

Verified live: promote mutation updates salary, writes history/audit, and
the detail page reflects it after refresh, no console errors.

Note: the spec's Karenz-verwalten panel only covers employees already on
Karenz; added a start-Karenz mode (Karenzbeginn/geplante Rueckkehr) to
cover the Aktiv-employee case implied by the header button but not
specified in the panel list.

actions/positions.ts

@@ -0,0 +1,36 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { createClient } from "@/lib/supabase/server";
+
+type ActionResult = { success: boolean; error?: string };
+
+export async function createPosition(payload: {
+  title: string;
+  superior_employee_id: string;
+  is_lead: boolean;
+  team_id?: string;
+}): Promise<ActionResult> {
+  const supabase = await createClient();
+  const { error } = await supabase.rpc("create_position", { payload });
+  if (error) return { success: false, error: error.message };
+  revalidatePath("/positions");
+  revalidatePath("/orgchart");
+  revalidatePath("/");
+  return { success: true };
+}
+
+export async function staffPositionInternally(payload: {
+  position_id: string;
+  employee_id: string;
+}): Promise<ActionResult> {
+  const supabase = await createClient();
+  const { error } = await supabase.rpc("staff_position_internally", { payload });
+  if (error) return { success: false, error: error.message };
+  revalidatePath("/positions");
+  revalidatePath("/orgchart");
+  revalidatePath("/employees");
+  revalidatePath(`/employees/${payload.employee_id}`);
+  revalidatePath("/");
+  return { success: true };
+}