Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

actions/employees.ts

@@ -31,7 +31,6 @@ export async function hireEmployee(payload: {
   contract_end_date?: string;
   employment_type?: "Vollzeit" | "Teilzeit";
   weekly_hours?: number;
-  monthly_salary_gross: number;
   paygrade?: "A" | "B" | "C" | "D" | "E" | "F";
   source: "Intern" | "Extern";
 }): Promise<ActionResult & { employeeId?: string }> {
@@ -66,7 +65,6 @@ export async function promoteEmployee(payload: {
   employee_id: string;
   effective_date: string;
   new_title: string;
-  new_salary: number;
   new_paygrade?: "A" | "B" | "C" | "D" | "E" | "F";
 }): Promise<ActionResult> {
   return callRpc("promote_employee", payload, [`/employees/${payload.employee_id}`, "/employees"]);
@@ -119,7 +117,7 @@ export type EmployeeSearchResult = { id: string; first_name: string; last_name:
 export async function searchActiveEmployees(query: string): Promise<EmployeeSearchResult[]> {
   const supabase = await createClient();
   let q = supabase
-    .from("employees_directory")
+    .from("employees")
     .select("id, first_name, last_name, job_title, team_id")
     .in("status", ["Aktiv", "Karenz"])
     .limit(20);