Org assignment history, mobile support, and a correctness pass

Data model
- employee_assignments records org placement over time (valid_from/valid_to),
  written by a trigger on `employees` rather than inside each RPC: ~70
  `update employees` statements spread over fifteen migrations mean per-call
  bookkeeping would miss paths today and again with every future RPC. A
  partial unique index enforces the one-open-interval invariant the trigger
  relies on when closing the current row.
- The Organigramm gains a Stichtag (default today). Membership comes from
  entry/exit/karenz, past placement from the new history, future placement
  projected from pending_org_changes. Placements predating the migration are
  backfilled with today's values and flagged as such in the UI, since
  employee_history only ever stored free text and cannot be reconstructed.

Correctness
- Reports and exports silently truncated at PostgREST's 1000-row cap
  (db.max_rows); employee_history is already past it at ~800 staff. Every
  whole-table read now pages explicitly.
- XLSX date cells were a day early: ExcelJS converts a Date to an Excel
  serial straight off getTime(), so a Date built at local midnight lands on
  the previous day's serial in any positive-offset zone.
- Date handling is pinned to Europe/Vienna throughout, and date-only strings
  are formatted without a Date round-trip. The dashboard's YTD window was
  built by round-tripping a local Date through toISOString(), which shifted
  it a day early and dropped 31 December entirely.
- Export routes parsed measure/group/split/eventType with unchecked `as`
  casts, so an unknown value reached column headers as `undefined` and the
  Content-Disposition filename. Parsed against the label maps now, with the
  filename slugged as a backstop.
- toXlsx keyed columns by header text, silently dropping the second of any
  two columns sharing a name — split columns take their header from data.
- The org chart tree walks had no cycle guard; nothing in the schema forbids
  a manager_id cycle, and one would hang the tab rather than misreport.
- The login page reflected ?error= verbatim, letting anyone put arbitrary
  text on the real sign-in screen; messages are looked up by code now.
- React Flow needs elementsSelectable on, or it sets pointer-events:none on
  the whole node and the expand control stops responding.

UI
- Mobile: the shell was unusable below lg — a fixed 236px margin pushed
  content off-screen with no mobile navigation at all. The sidebar is now a
  drawer, dvh replaces vh, safe-area insets are honoured, inputs are 16px so
  iOS stops zooming on focus, and form grids stack.
- Org chart nodes redesigned: per-kind accent stripes and icons, vacant
  roles called out, expand control moved to the bottom edge carrying the
  child count.
- Pagination is windowed; it previously rendered one link per page (54 for
  the employee list, unbounded for the audit log).
- Positions page reduced to open positions with a single "Besetzen" action.
- The employee Organisation tab links into the org chart focused on that
  person, reusing the chart's existing search-match highlighting.

Also included, uncommitted until now
- Dependants, HR notes, academic titles, split address fields, position
  validity and role/employment fields, with their migrations and UI.
- Docker/compose deployment setup, data-model and security-review docs.

tests/integration/assignment-history.test.ts

@@ -0,0 +1,140 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import type { Database } from "@/lib/supabase/types";
+import {
+  adminClient,
+  createHrUser,
+  deleteTestEmployee,
+  deleteTestUser,
+  hireTestEmployee,
+  isoDateOffset,
+  pickSeededTeam,
+  signInAs,
+  type TestUser,
+} from "./helpers";
+
+// Org-assignment history (supabase/migrations/20260724120000_employee_
+// assignment_history.sql). The point of capturing this with a trigger rather
+// than inside each RPC is that it holds for *every* write path — so these
+// tests drive the real RPCs and assert on the timeline they leave behind.
+describe("employee_assignments history", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let teamA: { id: string };
+  let teamB: { id: string };
+  const employeeIds: string[] = [];
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    teamA = await pickSeededTeam();
+    teamB = await pickSeededTeam(teamA.id);
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function freshEmployee(teamId: string): Promise<string> {
+    const id = await hireTestEmployee(hrClient, teamId);
+    employeeIds.push(id);
+    return id;
+  }
+
+  async function assignmentsFor(employeeId: string) {
+    const { data } = await adminClient
+      .from("employee_assignments")
+      .select("team_id, job_title, valid_from, valid_to")
+      .eq("employee_id", employeeId)
+      .order("valid_from");
+    return data ?? [];
+  }
+
+  it("opens an interval when an employee is hired", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const rows = await assignmentsFor(employeeId);
+    expect(rows).toHaveLength(1);
+    expect(rows[0].team_id).toBe(teamA.id);
+    expect(rows[0].valid_to).toBeNull();
+  });
+
+  it("closes the old interval and opens a new one on transfer", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const { error } = await hrClient.rpc("transfer_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(0), new_team_id: teamB.id },
+    });
+    expect(error).toBeNull();
+
+    const rows = await assignmentsFor(employeeId);
+    expect(rows).toHaveLength(2);
+    expect(rows[0].team_id).toBe(teamA.id);
+    expect(rows[0].valid_to).toBe(isoDateOffset(0));
+    expect(rows[1].team_id).toBe(teamB.id);
+    expect(rows[1].valid_to).toBeNull();
+    // Intervals must abut exactly, or an as-of query lands in a gap.
+    expect(rows[1].valid_from).toBe(rows[0].valid_to);
+  });
+
+  it("rewrites in place rather than leaving a zero-length interval for a same-day second move", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    await hrClient.rpc("transfer_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(0), new_team_id: teamB.id },
+    });
+    await hrClient.rpc("transfer_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(0), new_team_id: teamA.id },
+    });
+
+    const rows = await assignmentsFor(employeeId);
+    expect(rows.every((r) => r.valid_to === null || r.valid_to > r.valid_from)).toBe(true);
+    expect(rows.filter((r) => r.valid_to === null)).toHaveLength(1);
+    expect(rows.at(-1)?.team_id).toBe(teamA.id);
+  });
+
+  it("records a promotion's new title as its own interval", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const { error } = await hrClient.rpc("promote_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(0), new_title: "Senior Testtitel" },
+    });
+    expect(error).toBeNull();
+
+    const rows = await assignmentsFor(employeeId);
+    expect(rows.at(-1)?.job_title).toBe("Senior Testtitel");
+    expect(rows.at(-1)?.valid_to).toBeNull();
+  });
+
+  it("writes no new interval when nothing about the placement changed", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const before = await assignmentsFor(employeeId);
+
+    const { error } = await hrClient.rpc("change_employee_data", {
+      payload: {
+        employee_id: employeeId,
+        effective_date: isoDateOffset(0),
+        person: { phone: "+43 1 2345678" },
+        contract: {},
+        role: {},
+      },
+    });
+    expect(error).toBeNull();
+
+    expect(await assignmentsFor(employeeId)).toHaveLength(before.length);
+  });
+
+  it("keeps exactly one open interval per employee", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    await hrClient.rpc("transfer_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(0), new_team_id: teamB.id },
+    });
+    const rows = await assignmentsFor(employeeId);
+    expect(rows.filter((r) => r.valid_to === null)).toHaveLength(1);
+  });
+
+  it("is not readable without an active HR session", async () => {
+    const outsider = await createHrUser({ active: false });
+    const outsiderClient = await signInAs(outsider);
+    const { data } = await outsiderClient.from("employee_assignments").select("id").limit(1);
+    expect(data ?? []).toHaveLength(0);
+    await deleteTestUser(outsider);
+  });
+});