SVNR validation, CI, and a dependency/security pass

Positions
- Removed the "Besetzen" action, the StaffInternallyModal behind it and the
  now-unreachable staffPositionInternally server action: a position is filled
  through the hire process, not from the positions list. Note that
  transfer_employee has no position_id at all and never touched `positions`,
  so with staff_position_internally out of the UI, hire_employee is the only
  thing that closes a position — a transfer into an open one leaves it open.
  The RPC itself is still in the database and still covered by its tests.

SVNR
- Austrian social security numbers are now validated: ten digits, weighted
  check digit mod 11, and the TTMMJJ tail cross-checked against birth_date,
  which is what catches a transposed date that a valid check digit would let
  through. A serial whose weighted sum lands on 11 is rejected rather than
  wrapped — those are never issued.
- Applies to Austrian locations only; the German/Czech/Slovenian equivalents
  have their own formats and stay free-form.
- Enforced by a trigger, not inside hire_employee/change_employee_data, for
  the same reason as the assignment history: both have been redefined by
  half a dozen migrations. Only a *newly written* value is checked, so a
  legacy number never blocks an unrelated transfer or address change.
- The seed drew a random four-digit prefix, so its check digit was right
  only by chance and every seeded Austrian row would now be rejected;
  it computes the check digit properly now.

Tech stack
- next 16.2.11 closes nine advisories against 16.2.10, including a
  middleware/proxy bypass in App Router apps on Turbopack — proxy.ts is this
  app's entry gate. RLS remains the real boundary, so the blast radius was a
  blank page rather than data, but it is a patch-level fix. Also react
  19.2.8, tailwind 4.3.3, lucide-react 1.26, supabase-js/ssr, postcss.
- CI runs lint, typecheck, schema/type drift, tests and build; a second job
  replays every migration onto an empty database and runs the integration
  suite against it, so a migration that cannot be replayed from scratch
  fails here instead of during a restore.
- scripts/check-schema-types.mjs diffs the hand-written lib/supabase/types.ts
  against the migrations. Reading the SQL rather than a live database keeps
  Postgres out of the fast CI job. Verified in both directions.
- vitest now runs two projects: node for logic, jsdom for components. The
  first component test covers the org chart expand control, which broke
  earlier this session when elementsSelectable={false} made React Flow
  compute pointer-events:none for the whole node; re-introducing that prop
  fails three of these tests.
- Content-Security-Policy is emitted report-only. Enforcing a policy derived
  from inspection rather than from violation reports risks blanking the app;
  'unsafe-inline' on script-src is required until a nonce is threaded through
  proxy.ts, which is a separate change.
- Fixed supabase/seed.ts, which this session's SVNR change had broken: the
  extensionless "../lib/svnr" import does not resolve under Node's ESM
  loader, so the seed failed at startup.
- engines pinned to node >=22 <25, tsconfig target ES2022, and the dead
  test:e2e script removed (no Playwright is installed).

components/employees/EmployeeDetail.tsx

@@ -151,7 +151,13 @@ export function EmployeeDetail(props: EmployeeDetailProps) {
       />
       <PromotePanel open={panel === "promote"} onClose={() => setPanel(null)} employee={employee} />
       <KarenzPanel open={panel === "karenz"} onClose={() => setPanel(null)} employee={employee} />
-      <DatenAendernPanel open={panel === "daten"} onClose={() => setPanel(null)} employee={employee} dependents={dependents} />
+      <DatenAendernPanel
+        open={panel === "daten"}
+        onClose={() => setPanel(null)}
+        employee={employee}
+        dependents={dependents}
+        locationCountry={location?.country}
+      />
       <TerminatePanel open={panel === "terminate"} onClose={() => setPanel(null)} employee={employee} directReportCount={directReports.length} />
       <RehirePanel open={panel === "rehire"} onClose={() => setPanel(null)} employee={employee} />
     </div>

components/employees/SvNummerField.tsx

@@ -0,0 +1,59 @@
+"use client";
+
+import { useState } from "react";
+import { formatSvnr, requiresAustrianSvnr, svnrErrorMessage, validateSvnr } from "@/lib/svnr";
+
+type SvNummerFieldProps = {
+  value: string;
+  onChange: (value: string) => void;
+  /** Country of the employee's work location — validation applies to Austria only. */
+  locationCountry: string | null | undefined;
+  /** ISO yyyy-mm-dd; enables the cross-check against the TTMMJJ tail. */
+  birthDate?: string | null;
+  labelClassName?: string;
+};
+
+/**
+ * Shared by the hire wizard and the "Daten ändern" panel so both apply the
+ * same rule. Errors are shown only once the field has been left, so the
+ * message does not flash while the ten digits are still being typed.
+ */
+export function SvNummerField({ value, onChange, locationCountry, birthDate, labelClassName }: SvNummerFieldProps) {
+  const [touched, setTouched] = useState(false);
+  const applies = requiresAustrianSvnr(locationCountry);
+  const error = applies && value.trim() !== "" ? validateSvnr(value, birthDate) : null;
+  const showError = touched && error !== null;
+
+  return (
+    <div>
+      <label htmlFor="sv-nummer" className={labelClassName ?? "mb-1 block text-sm font-semibold text-ink"}>
+        SV-Nummer
+      </label>
+      <input
+        id="sv-nummer"
+        value={value}
+        inputMode="numeric"
+        placeholder={applies ? "1237 010180" : undefined}
+        onChange={(e) => onChange(e.target.value)}
+        onBlur={() => {
+          setTouched(true);
+          // Normalise to the conventional "NNNN TTMMJJ" spacing once the
+          // value is complete; anything else is left exactly as typed.
+          const formatted = formatSvnr(value);
+          if (formatted !== value) onChange(formatted);
+        }}
+        aria-invalid={showError || undefined}
+        aria-describedby={showError ? "sv-nummer-error" : undefined}
+        className={`w-full rounded border px-3 py-2 text-sm ${showError ? "border-danger-solid" : "border-border"}`}
+      />
+      {showError && (
+        <p id="sv-nummer-error" className="mt-1 text-xs font-semibold text-danger-text">
+          {svnrErrorMessage(error)}
+        </p>
+      )}
+      {applies && !showError && (
+        <p className="mt-1 text-xs text-ink-muted">10 Ziffern: laufende Nummer, Prüfziffer, Geburtsdatum (TTMMJJ).</p>
+      )}
+    </div>
+  );
+}

components/employees/panels/DatenAendernPanel.tsx

@@ -5,12 +5,14 @@ import { useState } from "react";
 import { changeEmployeeData } from "@/actions/employees";
 import { AngehoerigeSection } from "@/components/employees/AngehoerigeSection";
 import { RoleEmploymentFields, type RoleEmploymentValue } from "@/components/employees/RoleEmploymentFields";
+import { SvNummerField } from "@/components/employees/SvNummerField";
 import { TitleFields, type TitleValue } from "@/components/employees/TitleFields";
 import { CountryPicker } from "@/components/ui/CountryPicker";
 import { SlideOver } from "@/components/ui/SlideOver";
 import { useToast } from "@/components/ui/Toast";
 import { UN_COUNTRIES } from "@/lib/countries";
 import { fmtFullName, todayIso } from "@/lib/format";
+import { isValidSvnr, requiresAustrianSvnr } from "@/lib/svnr";
 import type { ContractType, Database, EmploymentType, GenderType } from "@/lib/supabase/types";
 
 type EmployeeRow = Database["public"]["Tables"]["employees"]["Row"];
@@ -21,15 +23,19 @@ export function DatenAendernPanel({
   onClose,
   employee,
   dependents,
+  locationCountry,
 }: {
   open: boolean;
   onClose: () => void;
   employee: EmployeeRow;
   dependents: Dependent[];
+  locationCountry: string | null | undefined;
 }) {
   const { showToast } = useToast();
   const router = useRouter();
   const [pending, setPending] = useState(false);
+  // The DB trigger would reject a bad number anyway; catching it here keeps
+  // the whole effective-dated change from being thrown away on submit.
   const [effectiveDate, setEffectiveDate] = useState(todayIso);
 
   const [firstName, setFirstName] = useState(employee.first_name);
@@ -41,6 +47,8 @@ export function DatenAendernPanel({
   const [gender, setGender] = useState<GenderType>(employee.gender);
   const [birthDate, setBirthDate] = useState(employee.birth_date);
   const [svNummer, setSvNummer] = useState(employee.sv_nummer ?? "");
+  const svNummerOk =
+    !svNummer.trim() || !requiresAustrianSvnr(locationCountry) || isValidSvnr(svNummer, birthDate || null);
   const [nationality, setNationality] = useState(employee.nationality);
   const [address, setAddress] = useState(employee.address ?? "");
   const [postalCode, setPostalCode] = useState(employee.postal_code ?? "");
@@ -148,7 +156,8 @@ export function DatenAendernPanel({
           </button>
           <button
             onClick={handleSubmit}
-            disabled={pending}
+            disabled={pending || !svNummerOk}
+            title={svNummerOk ? undefined : "Die SV-Nummer ist ungültig."}
             className="rounded bg-brand-500 px-4 py-2 text-sm font-semibold text-white disabled:opacity-50"
           >
             Speichern
@@ -199,10 +208,13 @@ export function DatenAendernPanel({
                 />
               </div>
             </div>
-            <div>
-              <label className="mb-1 block text-xs font-semibold text-ink-muted">SV-Nummer</label>
-              <input value={svNummer} onChange={(e) => setSvNummer(e.target.value)} className="w-full rounded border border-border px-3 py-2 text-sm" />
-            </div>
+            <SvNummerField
+              value={svNummer}
+              onChange={setSvNummer}
+              locationCountry={locationCountry}
+              birthDate={birthDate || null}
+              labelClassName="mb-1 block text-xs font-semibold text-ink-muted"
+            />
             <div>
               <label className="mb-1 block text-xs font-semibold text-ink-muted">Staatsbürgerschaft</label>
               <CountryPicker value={nationality} onChange={setNationality} countries={UN_COUNTRIES} placeholder="Staatsbürgerschaft suchen…" />