SVNR validation, CI, and a dependency/security pass

Positions
- Removed the "Besetzen" action, the StaffInternallyModal behind it and the
  now-unreachable staffPositionInternally server action: a position is filled
  through the hire process, not from the positions list. Note that
  transfer_employee has no position_id at all and never touched `positions`,
  so with staff_position_internally out of the UI, hire_employee is the only
  thing that closes a position — a transfer into an open one leaves it open.
  The RPC itself is still in the database and still covered by its tests.

SVNR
- Austrian social security numbers are now validated: ten digits, weighted
  check digit mod 11, and the TTMMJJ tail cross-checked against birth_date,
  which is what catches a transposed date that a valid check digit would let
  through. A serial whose weighted sum lands on 11 is rejected rather than
  wrapped — those are never issued.
- Applies to Austrian locations only; the German/Czech/Slovenian equivalents
  have their own formats and stay free-form.
- Enforced by a trigger, not inside hire_employee/change_employee_data, for
  the same reason as the assignment history: both have been redefined by
  half a dozen migrations. Only a *newly written* value is checked, so a
  legacy number never blocks an unrelated transfer or address change.
- The seed drew a random four-digit prefix, so its check digit was right
  only by chance and every seeded Austrian row would now be rejected;
  it computes the check digit properly now.

Tech stack
- next 16.2.11 closes nine advisories against 16.2.10, including a
  middleware/proxy bypass in App Router apps on Turbopack — proxy.ts is this
  app's entry gate. RLS remains the real boundary, so the blast radius was a
  blank page rather than data, but it is a patch-level fix. Also react
  19.2.8, tailwind 4.3.3, lucide-react 1.26, supabase-js/ssr, postcss.
- CI runs lint, typecheck, schema/type drift, tests and build; a second job
  replays every migration onto an empty database and runs the integration
  suite against it, so a migration that cannot be replayed from scratch
  fails here instead of during a restore.
- scripts/check-schema-types.mjs diffs the hand-written lib/supabase/types.ts
  against the migrations. Reading the SQL rather than a live database keeps
  Postgres out of the fast CI job. Verified in both directions.
- vitest now runs two projects: node for logic, jsdom for components. The
  first component test covers the org chart expand control, which broke
  earlier this session when elementsSelectable={false} made React Flow
  compute pointer-events:none for the whole node; re-introducing that prop
  fails three of these tests.
- Content-Security-Policy is emitted report-only. Enforcing a policy derived
  from inspection rather than from violation reports risks blanking the app;
  'unsafe-inline' on script-src is required until a nonce is threaded through
  proxy.ts, which is a separate change.
- Fixed supabase/seed.ts, which this session's SVNR change had broken: the
  extensionless "../lib/svnr" import does not resolve under Node's ESM
  loader, so the seed failed at startup.
- engines pinned to node >=22 <25, tsconfig target ES2022, and the dead
  test:e2e script removed (no Playwright is installed).

supabase/migrations/20260725120000_svnr_validation.sql

@@ -0,0 +1,99 @@
+-- Validation of the Austrian Sozialversicherungsnummer (SVNR).
+--
+-- `sv_nummer` has been free text since the initial schema. For employees at
+-- an Austrian location it follows a fixed standard — three-digit serial,
+-- check digit, then TTMMJJ — and the check digit is verifiable, so typos
+-- that would otherwise surface at the payroll interface can be caught on
+-- entry. Employees at the German/Czech/Slovenian locations keep the field
+-- free-form; their national equivalents have different formats.
+--
+-- Enforced by a trigger rather than inside hire_employee/change_employee_data
+-- for the same reason as the assignment history: both functions have been
+-- redefined by half a dozen migrations, and a check in the table catches
+-- every write path including ones added later.
+
+create or replace function is_valid_svnr(p_svnr text, p_birth_date date default null)
+returns boolean
+language plpgsql
+immutable
+as $$
+declare
+  v text := regexp_replace(coalesce(p_svnr, ''), '[\s./-]', '', 'g');
+  v_weights int[] := array[3, 7, 9, 0, 5, 8, 4, 2, 1, 6];
+  v_days_in_month int[] := array[31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  v_sum int := 0;
+  v_day int;
+  v_month int;
+  v_check int;
+begin
+  if v !~ '^\d{10}$' then return false; end if;
+  -- 000 is never issued as a serial.
+  if substr(v, 1, 3) = '000' then return false; end if;
+
+  v_day := substr(v, 5, 2)::int;
+  v_month := substr(v, 7, 2)::int;
+  if v_month < 1 or v_month > 12 or v_day < 1 then return false; end if;
+  -- February is allowed 29 days: a two-digit year cannot tell us whether the
+  -- year was a leap year, so the generous bound is the correct one here.
+  if v_day > v_days_in_month[v_month] then return false; end if;
+
+  for i in 1..10 loop
+    if i <> 4 then
+      v_sum := v_sum + substr(v, i, 1)::int * v_weights[i];
+    end if;
+  end loop;
+
+  v_check := v_sum % 11;
+  -- A serial whose weighted sum lands on 11 leaves no single digit to use,
+  -- so that serial is skipped rather than wrapped around.
+  if v_check = 10 then return false; end if;
+  if v_check <> substr(v, 4, 1)::int then return false; end if;
+
+  if p_birth_date is not null and to_char(p_birth_date, 'DDMMYY') <> substr(v, 5, 6) then
+    return false;
+  end if;
+
+  return true;
+end;
+$$;
+
+comment on function is_valid_svnr(text, date) is
+  'Prüft eine österreichische SV-Nummer (10 Ziffern, Prüfziffer mod 11). Mit p_birth_date wird zusätzlich der TTMMJJ-Teil gegen das Geburtsdatum geprüft.';
+
+create or replace function fn_validate_employee_svnr()
+returns trigger
+language plpgsql
+as $$
+declare
+  v_country text;
+begin
+  if new.sv_nummer is null or btrim(new.sv_nummer) = '' then
+    return new;
+  end if;
+
+  -- Only a *newly written* value is checked. Rows that predate this
+  -- migration keep whatever they hold, so an unrelated edit — a transfer, a
+  -- promotion, an address change — is never blocked by a legacy value the
+  -- user is not touching.
+  if tg_op = 'UPDATE' and new.sv_nummer is not distinct from old.sv_nummer then
+    return new;
+  end if;
+
+  select country into v_country from locations where id = new.location_id;
+  if v_country is distinct from 'Österreich' then
+    return new;
+  end if;
+
+  if not is_valid_svnr(new.sv_nummer, new.birth_date) then
+    raise exception 'Ungültige SV-Nummer: %. Erwartet werden 10 Ziffern (laufende Nummer, Prüfziffer, TTMMJJ) mit gültiger Prüfziffer und dem Geburtsdatum des/der Mitarbeiter:in.', new.sv_nummer
+      using errcode = '23514';
+  end if;
+
+  return new;
+end;
+$$;
+
+drop trigger if exists trg_validate_employee_svnr on employees;
+create trigger trg_validate_employee_svnr
+before insert or update on employees
+for each row execute function fn_validate_employee_svnr();

supabase/seed.ts

@@ -8,6 +8,9 @@
 
 import { createClient } from "@supabase/supabase-js";
 import { randomUUID } from "node:crypto";
+// Explicit .ts extension: this file is run directly by Node (type-stripping,
+// ESM), where an extensionless relative import does not resolve.
+import { svnrCheckDigit } from "../lib/svnr.ts";
 
 const SUPABASE_URL = process.env.NEXT_PUBLIC_SUPABASE_URL;
 const SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
@@ -365,12 +368,22 @@ function makeEmail(firstName: string, lastName: string): string {
   return email;
 }
 
+// Used a random four-digit prefix before, so the check digit was right only
+// by chance — which the SVNR validation trigger now rejects outright. The
+// serial is still random; only the check digit is computed for it.
 function makeSvNummer(birthDate: Date): string {
   const dd = String(birthDate.getDate()).padStart(2, "0");
   const mm = String(birthDate.getMonth() + 1).padStart(2, "0");
   const yy = String(birthDate.getFullYear()).slice(-2);
-  const prefix = String(randInt(1000, 9999));
-  return `${prefix} ${dd}${mm}${yy}`;
+  const tail = `${dd}${mm}${yy}`;
+
+  // Not every serial yields a usable check digit (a weighted sum of 11 is
+  // skipped rather than wrapped), so draw until one does.
+  for (;;) {
+    const serial = String(randInt(1, 999)).padStart(3, "0");
+    const check = svnrCheckDigit(`${serial}0${tail}`);
+    if (check !== null) return `${serial}${check} ${tail}`;
+  }
 }
 
 function birthDateForAge(age: number): Date {