Org assignment history, mobile support, and a correctness pass

Data model
- employee_assignments records org placement over time (valid_from/valid_to),
  written by a trigger on `employees` rather than inside each RPC: ~70
  `update employees` statements spread over fifteen migrations mean per-call
  bookkeeping would miss paths today and again with every future RPC. A
  partial unique index enforces the one-open-interval invariant the trigger
  relies on when closing the current row.
- The Organigramm gains a Stichtag (default today). Membership comes from
  entry/exit/karenz, past placement from the new history, future placement
  projected from pending_org_changes. Placements predating the migration are
  backfilled with today's values and flagged as such in the UI, since
  employee_history only ever stored free text and cannot be reconstructed.

Correctness
- Reports and exports silently truncated at PostgREST's 1000-row cap
  (db.max_rows); employee_history is already past it at ~800 staff. Every
  whole-table read now pages explicitly.
- XLSX date cells were a day early: ExcelJS converts a Date to an Excel
  serial straight off getTime(), so a Date built at local midnight lands on
  the previous day's serial in any positive-offset zone.
- Date handling is pinned to Europe/Vienna throughout, and date-only strings
  are formatted without a Date round-trip. The dashboard's YTD window was
  built by round-tripping a local Date through toISOString(), which shifted
  it a day early and dropped 31 December entirely.
- Export routes parsed measure/group/split/eventType with unchecked `as`
  casts, so an unknown value reached column headers as `undefined` and the
  Content-Disposition filename. Parsed against the label maps now, with the
  filename slugged as a backstop.
- toXlsx keyed columns by header text, silently dropping the second of any
  two columns sharing a name — split columns take their header from data.
- The org chart tree walks had no cycle guard; nothing in the schema forbids
  a manager_id cycle, and one would hang the tab rather than misreport.
- The login page reflected ?error= verbatim, letting anyone put arbitrary
  text on the real sign-in screen; messages are looked up by code now.
- React Flow needs elementsSelectable on, or it sets pointer-events:none on
  the whole node and the expand control stops responding.

UI
- Mobile: the shell was unusable below lg — a fixed 236px margin pushed
  content off-screen with no mobile navigation at all. The sidebar is now a
  drawer, dvh replaces vh, safe-area insets are honoured, inputs are 16px so
  iOS stops zooming on focus, and form grids stack.
- Org chart nodes redesigned: per-kind accent stripes and icons, vacant
  roles called out, expand control moved to the bottom edge carrying the
  child count.
- Pagination is windowed; it previously rendered one link per page (54 for
  the employee list, unbounded for the audit log).
- Positions page reduced to open positions with a single "Besetzen" action.
- The employee Organisation tab links into the org chart focused on that
  person, reusing the chart's existing search-match highlighting.

Also included, uncommitted until now
- Dependants, HR notes, academic titles, split address fields, position
  validity and role/employment fields, with their migrations and UI.
- Docker/compose deployment setup, data-model and security-review docs.

lib/reports-data.ts

@@ -1,5 +1,6 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
 import { deriveStatusAsOf, EVENT_DATE_OPEN, parseStatuses, todayIso, type OrgLookups, type ReportEmployee, type ReportEvent } from "./reports";
+import { fetchAllRows } from "./supabase/query";
 import type { Database, EmploymentType, HistoryEventType } from "./supabase/types";
 
 // Shared by the Berichte page and /api/export/* so they can never drift on
@@ -41,7 +42,19 @@ export async function loadOrgLookups(supabase: SupabaseClient<Database>): Promis
 }
 
 const SNAPSHOT_EMPLOYEE_COLUMNS =
-  "id, first_name, last_name, job_title, division_id, team_id, location_id, employment_type, contract_type, entry_date, exit_date, weekly_hours, source, paygrade, birth_date, gender, karenz_start_date, karenz_return_date";
+  "id, first_name, last_name, job_title, division_id, team_id, location_id, employment_type, contract_type, entry_date, exit_date, weekly_hours, source, paygrade, birth_date, gender, karenz_start_date, karenz_return_date, worker_type, collective_agreement, work_days, is_betriebsrat, has_dienstwagen, is_laterale_fuehrung, is_c_level";
+
+// employee_id -> number of employee_dependents rows. Selects only the FK
+// column (no dependent PII needed) since only per-employee counts feed the
+// has_dependents/avg_dependents report dimensions; counted client-side
+// since the Supabase JS client has no `count(*) group by employee_id`
+// shorthand. Shared by the Bestand pivot and the full employees export.
+export async function loadDependentsCounts(supabase: SupabaseClient<Database>): Promise<Map<string, number>> {
+  const rows = await fetchAllRows(() => supabase.from("employee_dependents").select("employee_id").order("employee_id"));
+  const counts = new Map<string, number>();
+  for (const d of rows) counts.set(d.employee_id, (counts.get(d.employee_id) ?? 0) + 1);
+  return counts;
+}
 
 // Bestand zum Stichtag: reconstructs each employee's status as of `asOf`
 // (defaults to today) from entry/exit/Karenz dates — see deriveStatusAsOf.
@@ -49,14 +62,17 @@ const SNAPSHOT_EMPLOYEE_COLUMNS =
 export async function loadSnapshotEmployees(supabase: SupabaseClient<Database>, filters: SnapshotFilters): Promise<ReportEmployee[]> {
   const asOf = filters.asOf || todayIso();
 
-  let query = supabase.from("employees").select(SNAPSHOT_EMPLOYEE_COLUMNS);
-  if (filters.division) query = query.eq("division_id", filters.division);
-  if (filters.location) query = query.eq("location_id", filters.location);
-  if (filters.employment) query = query.eq("employment_type", filters.employment as EmploymentType);
+  function snapshotQuery() {
+    let query = supabase.from("employees").select(SNAPSHOT_EMPLOYEE_COLUMNS).order("id");
+    if (filters.division) query = query.eq("division_id", filters.division);
+    if (filters.location) query = query.eq("location_id", filters.location);
+    if (filters.employment) query = query.eq("employment_type", filters.employment as EmploymentType);
+    return query;
+  }
 
-  const { data } = await query;
+  const [data, dependentsCounts] = await Promise.all([fetchAllRows(snapshotQuery), loadDependentsCounts(supabase)]);
 
-  const withDerivedStatus: ReportEmployee[] = (data ?? []).map((e) => ({
+  const withDerivedStatus: ReportEmployee[] = data.map((e) => ({
     id: e.id,
     first_name: e.first_name,
     last_name: e.last_name,
@@ -74,6 +90,14 @@ export async function loadSnapshotEmployees(supabase: SupabaseClient<Database>,
     paygrade: e.paygrade,
     birth_date: e.birth_date,
     gender: e.gender,
+    worker_type: e.worker_type,
+    collective_agreement: e.collective_agreement,
+    work_days: e.work_days,
+    is_betriebsrat: e.is_betriebsrat,
+    has_dienstwagen: e.has_dienstwagen,
+    is_laterale_fuehrung: e.is_laterale_fuehrung,
+    is_c_level: e.is_c_level,
+    dependents_count: dependentsCounts.get(e.id) ?? 0,
   }));
 
   const statuses = parseStatuses(filters.status);
@@ -93,19 +117,22 @@ export async function loadEventHistory(supabase: SupabaseClient<Database>, filte
   const from = filters.from === EVENT_DATE_OPEN ? undefined : filters.from || `${currentYear}-01-01`;
   const to = filters.to === EVENT_DATE_OPEN ? undefined : filters.to || `${currentYear}-12-31`;
 
-  let historyQuery = supabase.from("employee_history").select("employee_id, event_date, event_type, description");
-  if (from) historyQuery = historyQuery.gte("event_date", from);
-  if (to) historyQuery = historyQuery.lte("event_date", to);
-  if (filters.eventType) historyQuery = historyQuery.eq("event_type", filters.eventType);
+  function historyQuery() {
+    let query = supabase.from("employee_history").select("employee_id, event_date, event_type, description").order("id");
+    if (from) query = query.gte("event_date", from);
+    if (to) query = query.lte("event_date", to);
+    if (filters.eventType) query = query.eq("event_type", filters.eventType);
+    return query;
+  }
 
-  const [{ data: history }, { data: employees }] = await Promise.all([
-    historyQuery,
-    supabase.from("employees").select("id, first_name, last_name, job_title, division_id, team_id, location_id"),
+  const [history, employees] = await Promise.all([
+    fetchAllRows(historyQuery),
+    fetchAllRows(() => supabase.from("employees").select("id, first_name, last_name, job_title, division_id, team_id, location_id").order("id")),
   ]);
 
-  const employeeById = new Map((employees ?? []).map((e) => [e.id, e]));
+  const employeeById = new Map(employees.map((e) => [e.id, e]));
   const events: ReportEvent[] = [];
-  for (const h of history ?? []) {
+  for (const h of history) {
     const emp = employeeById.get(h.employee_id);
     if (!emp) continue;
     if (filters.division && emp.division_id !== filters.division) continue;