Write down what is actually in the database

The one document describing the schema, docs/data-model.md, predates two
rebuilds. It names divisions/departments/teams and a positions table that
no longer exist, describes Supabase auth with an anon key and a service
role that were removed, and puts the policy count at 58 when it is 21.
Anyone reading it to understand the data would have been misled on every
count.

docs/datenkatalog.md replaces it, and was not typed up from memory: the
columns, defaults, keys and check constraints were read out of
information_schema and pg_catalog on the running database. Fifteen
tables, 142 columns, ten enum types, 21 policies. Where a rule appears in
prose, the constraint it comes from is named next to it.

Some of it only became visible by asking the database rather than the
migrations. generate_company_email and the is_hr_admin pair are still
defined but nothing calls them any more. Position numbers look like a
six followed by seven digits because the generator builds them that way,
not because anything enforces it — the column requires only uniqueness.
monthly_salary_gross is dead weight kept in case old rows hold data.

Three claims I drafted were wrong and the database said so: the position
number format, the event trigger's name (ensure_rls, the function behind
it is rls_auto_enable), and which tables deviate from the plain
is_hr_user() policy.

The old document keeps a pointer at the top instead of being deleted —
it is linked from the security review, and a stale document that says so
is more useful than a dead link.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -88,7 +88,7 @@ selbst spricht. Ein Docker-Abbild ist damit umgebungsneutral: einmal gebaut,
   Ersatzkontrolle.
 - **Ein Rollenmodell:** `profiles.role = 'hr'` + `profiles.is_active = true`,
   geprüft über die SQL-Funktion `is_hr_user()`. Kein Sub-Rollensystem —
-  siehe [`docs/data-model.md`](docs/data-model.md#zugriffsmodell).
+  siehe [`docs/datenkatalog.md`](docs/datenkatalog.md#zugriffsschutz).
 - **Es gibt keinen privilegierten Zugang mehr.** Der Dienstschlüssel, der RLS
   aushebelte, ist ersatzlos entfallen; auch der nächtliche Lauf benutzt
   dieselbe Rolle ohne `BYPASSRLS`. Was ohne angemeldete Person laufen muss,
@@ -122,7 +122,8 @@ selbst spricht. Ein Docker-Abbild ist damit umgebungsneutral: einmal gebaut,
 ## Supabase-Hinweise
 
 - Schema-Quelle der Wahrheit: `supabase/migrations/`. Menschlich lesbare
-  Zusammenfassung: [`docs/data-model.md`](docs/data-model.md).
+  Fassung, aus der laufenden Datenbank erzeugt:
+  [`docs/datenkatalog.md`](docs/datenkatalog.md).
 - Migrationen einspielen: `supabase db push` (gegen das verlinkte Projekt)
   bzw. `supabase start` + automatische Anwendung für lokale Entwicklung.
 - `supabase/seed.ts` und `.env.test.local` sind nur für lokale