SVNR validation, CI, and a dependency/security pass

Positions
- Removed the "Besetzen" action, the StaffInternallyModal behind it and the
  now-unreachable staffPositionInternally server action: a position is filled
  through the hire process, not from the positions list. Note that
  transfer_employee has no position_id at all and never touched `positions`,
  so with staff_position_internally out of the UI, hire_employee is the only
  thing that closes a position — a transfer into an open one leaves it open.
  The RPC itself is still in the database and still covered by its tests.

SVNR
- Austrian social security numbers are now validated: ten digits, weighted
  check digit mod 11, and the TTMMJJ tail cross-checked against birth_date,
  which is what catches a transposed date that a valid check digit would let
  through. A serial whose weighted sum lands on 11 is rejected rather than
  wrapped — those are never issued.
- Applies to Austrian locations only; the German/Czech/Slovenian equivalents
  have their own formats and stay free-form.
- Enforced by a trigger, not inside hire_employee/change_employee_data, for
  the same reason as the assignment history: both have been redefined by
  half a dozen migrations. Only a *newly written* value is checked, so a
  legacy number never blocks an unrelated transfer or address change.
- The seed drew a random four-digit prefix, so its check digit was right
  only by chance and every seeded Austrian row would now be rejected;
  it computes the check digit properly now.

Tech stack
- next 16.2.11 closes nine advisories against 16.2.10, including a
  middleware/proxy bypass in App Router apps on Turbopack — proxy.ts is this
  app's entry gate. RLS remains the real boundary, so the blast radius was a
  blank page rather than data, but it is a patch-level fix. Also react
  19.2.8, tailwind 4.3.3, lucide-react 1.26, supabase-js/ssr, postcss.
- CI runs lint, typecheck, schema/type drift, tests and build; a second job
  replays every migration onto an empty database and runs the integration
  suite against it, so a migration that cannot be replayed from scratch
  fails here instead of during a restore.
- scripts/check-schema-types.mjs diffs the hand-written lib/supabase/types.ts
  against the migrations. Reading the SQL rather than a live database keeps
  Postgres out of the fast CI job. Verified in both directions.
- vitest now runs two projects: node for logic, jsdom for components. The
  first component test covers the org chart expand control, which broke
  earlier this session when elementsSelectable={false} made React Flow
  compute pointer-events:none for the whole node; re-introducing that prop
  fails three of these tests.
- Content-Security-Policy is emitted report-only. Enforcing a policy derived
  from inspection rather than from violation reports risks blanking the app;
  'unsafe-inline' on script-src is required until a nonce is threaded through
  proxy.ts, which is a separate change.
- Fixed supabase/seed.ts, which this session's SVNR change had broken: the
  extensionless "../lib/svnr" import does not resolve under Node's ESM
  loader, so the seed failed at startup.
- engines pinned to node >=22 <25, tsconfig target ES2022, and the dead
  test:e2e script removed (no Playwright is installed).

components/positions/PositionsPageClient.tsx

@@ -8,7 +8,6 @@ import { useToast } from "@/components/ui/Toast";
 import { fmtDate, todayIso } from "@/lib/format";
 import type { OpenPositionResolved } from "@/lib/positions";
 import { CreatePositionModal } from "./CreatePositionModal";
-import { StaffInternallyModal } from "./StaffInternallyModal";
 
 type OpenPositionWithDays = OpenPositionResolved & { daysOpen: number };
 
@@ -21,7 +20,6 @@ export function PositionsPageClient({ openPositions, teams }: PositionsPageClien
   const { showToast } = useToast();
   const router = useRouter();
   const [createOpen, setCreateOpen] = useState(false);
-  const [staffTarget, setStaffTarget] = useState<{ id: string; title: string; is_lead: boolean } | null>(null);
   const [deletingId, setDeletingId] = useState<string | null>(null);
   const today = todayIso();
 
@@ -76,15 +74,6 @@ export function PositionsPageClient({ openPositions, teams }: PositionsPageClien
                   </div>
                   <div className="mt-1 text-xs text-ink-muted">seit {p.daysOpen} Tagen offen</div>
                   {notYetValid && <div className="mt-1 text-xs font-semibold text-warning-text">Gültig ab {fmtDate(p.valid_from)}</div>}
-                  <button
-                    type="button"
-                    onClick={() => setStaffTarget({ id: p.id, title: p.title, is_lead: p.is_lead })}
-                    disabled={notYetValid}
-                    title={notYetValid ? `Position ist erst ab ${fmtDate(p.valid_from)} gültig.` : undefined}
-                    className="mt-3 w-full rounded bg-brand-500 px-3 py-2 text-xs font-semibold text-white hover:bg-brand-600 disabled:opacity-50"
-                  >
-                    Besetzen
-                  </button>
                 </div>
               );
             })}
@@ -93,15 +82,6 @@ export function PositionsPageClient({ openPositions, teams }: PositionsPageClien
       </div>
 
       <CreatePositionModal open={createOpen} onClose={() => setCreateOpen(false)} teams={teams} />
-      {staffTarget && (
-        <StaffInternallyModal
-          open={Boolean(staffTarget)}
-          onClose={() => setStaffTarget(null)}
-          positionId={staffTarget.id}
-          positionTitle={staffTarget.title}
-          isLead={staffTarget.is_lead}
-        />
-      )}
     </div>
   );
 }

components/positions/StaffInternallyModal.tsx

@@ -1,102 +0,0 @@
-"use client";
-
-import { useRouter } from "next/navigation";
-import { useState } from "react";
-import { searchActiveEmployees, type EmployeeSearchResult } from "@/actions/employees";
-import { staffPositionInternally } from "@/actions/positions";
-import { Lookup } from "@/components/ui/Lookup";
-import { Modal } from "@/components/ui/Modal";
-import { useToast } from "@/components/ui/Toast";
-
-type StaffInternallyModalProps = {
-  open: boolean;
-  onClose: () => void;
-  positionId: string;
-  positionTitle: string;
-  isLead: boolean;
-};
-
-export function StaffInternallyModal({ open, onClose, positionId, positionTitle, isLead }: StaffInternallyModalProps) {
-  const { showToast } = useToast();
-  const router = useRouter();
-  const [employee, setEmployee] = useState<EmployeeSearchResult | null>(null);
-  const [pending, setPending] = useState(false);
-
-  async function handleSubmit() {
-    if (!employee) return;
-    setPending(true);
-    const result = await staffPositionInternally({ position_id: positionId, employee_id: employee.id });
-    setPending(false);
-    if (result.success) {
-      showToast(`${employee.first_name} ${employee.last_name} besetzt die Position.`);
-      router.refresh();
-      onClose();
-      setEmployee(null);
-    } else {
-      showToast(result.error ?? "Fehler beim Besetzen.", "error");
-    }
-  }
-
-  return (
-    <Modal
-      open={open}
-      onClose={onClose}
-      title="Position besetzen"
-      footer={
-        <>
-          <button onClick={onClose} className="rounded px-4 py-2 text-sm font-semibold text-ink-body hover:bg-surface">
-            Abbrechen
-          </button>
-          <button
-            onClick={handleSubmit}
-            disabled={pending || !employee}
-            className="rounded bg-brand-500 px-4 py-2 text-sm font-semibold text-white disabled:opacity-50"
-          >
-            Besetzen
-          </button>
-        </>
-      }
-    >
-      <div className="flex flex-col gap-4">
-        <p className="text-sm text-ink-body">
-          Position: <span className="font-semibold">{positionTitle}</span>
-        </p>
-        {isLead && (
-          <div className="rounded bg-warning-bg px-3 py-2 text-sm text-warning-text">
-            Dies ist eine Führungsposition: Das gesamte Team wird der ausgewählten Person unterstellt.
-          </div>
-        )}
-        <div>
-          <label className="mb-1 block text-sm font-semibold text-ink">Mitarbeiter:in*</label>
-          {!employee ? (
-            <Lookup<EmployeeSearchResult>
-              placeholder="Name oder Titel…"
-              onSearch={searchActiveEmployees}
-              onSelect={setEmployee}
-              renderResult={(e) => (
-                <div>
-                  <div className="font-semibold text-ink">
-                    {e.first_name} {e.last_name}
-                  </div>
-                  <div className="text-xs text-ink-muted">{e.job_title}</div>
-                </div>
-              )}
-            />
-          ) : (
-            <div className="flex items-center justify-between rounded border border-border bg-surface p-3">
-              <div>
-                <div className="text-sm font-semibold text-ink">
-                  {employee.first_name} {employee.last_name}
-                </div>
-                <div className="text-xs text-ink-muted">{employee.job_title}</div>
-              </div>
-              <button type="button" onClick={() => setEmployee(null)} className="text-xs text-ink-muted hover:text-ink">
-                Ändern
-              </button>
-            </div>
-          )}
-        </div>
-      </div>
-    </Modal>
-  );
-}