Phase 2/3: Employees list/detail + mutation RPCs + action panels

- supabase/functions.sql, functions_2.sql: Postgres RPCs for every
  employee/position/reorg mutation (hire, terminate, transfer, promote,
  start/adjust/return karenz, change data, rehire, create position, staff
  internally, apply/undo reorg). Each resolves manager_id server-side,
  writes history + audit atomically, and enforces hr_admin via
  require_hr_admin() (backed by the existing RLS policy).
- actions/employees.ts, positions.ts, reorg.ts: Server Actions wrapping
  the RPCs, returning success/error for client-side toast handling.
- Employees list (search/filter/pagination) and detail (4 tabs: Stammdaten,
  Vertrag & Gehalt, Organisation, Historie) reading from employees_directory.
- 6 action slide-over panels: Transfer, Promote, Karenz (start/adjust/
  return), Daten aendern (person+contract diffing), Terminate (with direct-
  report reparenting warning + offboarding checklist), Rehire.
- lib/org.ts: shared division/department/team/location lookups.

Verified live: promote mutation updates salary, writes history/audit, and
the detail page reflects it after refresh, no console errors.

Note: the spec's Karenz-verwalten panel only covers employees already on
Karenz; added a start-Karenz mode (Karenzbeginn/geplante Rueckkehr) to
cover the Aktiv-employee case implied by the header button but not
specified in the panel list.

app/(app)/employees/[id]/page.tsx

@@ -0,0 +1,52 @@
+import { notFound } from "next/navigation";
+import { EmployeeDetail } from "@/components/employees/EmployeeDetail";
+import { createClient } from "@/lib/supabase/server";
+
+type PageProps = { params: Promise<{ id: string }> };
+
+export default async function EmployeeDetailPage({ params }: PageProps) {
+  const { id } = await params;
+  const supabase = await createClient();
+
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  const { data: profile } = await supabase.from("profiles").select("role").eq("id", user!.id).single();
+  const canEdit = profile?.role === "hr_admin";
+
+  const { data: employee } = await supabase.from("employees_directory").select("*").eq("id", id).single();
+  if (!employee) notFound();
+
+  const [{ data: manager }, { data: directReports }, { data: history }, { data: divisions }, { data: departments }, { data: teams }, { data: locations }, { data: openPositions }] =
+    await Promise.all([
+      employee.manager_id
+        ? supabase.from("employees_directory").select("id, first_name, last_name, job_title").eq("id", employee.manager_id).single()
+        : Promise.resolve({ data: null }),
+      supabase
+        .from("employees_directory")
+        .select("id, first_name, last_name, job_title, status")
+        .eq("manager_id", id)
+        .order("last_name"),
+      supabase.from("employee_history").select("*").eq("employee_id", id).order("event_date", { ascending: false }).order("created_at", { ascending: false }),
+      supabase.from("divisions").select("*").order("name"),
+      supabase.from("departments").select("*"),
+      supabase.from("teams").select("*"),
+      supabase.from("locations").select("*").order("name"),
+      supabase.from("positions").select("id, position_number, title, team_id, is_lead").eq("status", "open"),
+    ]);
+
+  return (
+    <EmployeeDetail
+      employee={employee}
+      manager={manager ?? null}
+      directReports={directReports ?? []}
+      history={history ?? []}
+      divisions={divisions ?? []}
+      departments={departments ?? []}
+      teams={teams ?? []}
+      locations={locations ?? []}
+      openPositions={openPositions ?? []}
+      canEdit={canEdit}
+    />
+  );
+}