Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

app/(app)/employees/[id]/page.tsx

@@ -8,22 +8,16 @@ export default async function EmployeeDetailPage({ params }: PageProps) {
   const { id } = await params;
   const supabase = await createClient();
 
-  const {
-    data: { user },
-  } = await supabase.auth.getUser();
-  const { data: profile } = await supabase.from("profiles").select("role").eq("id", user!.id).single();
-  const canEdit = profile?.role === "hr_admin";
-
-  const { data: employee } = await supabase.from("employees_directory").select("*").eq("id", id).single();
+  const { data: employee } = await supabase.from("employees").select("*").eq("id", id).single();
   if (!employee) notFound();
 
   const [{ data: manager }, { data: directReports }, { data: history }, { data: divisions }, { data: departments }, { data: teams }, { data: locations }, { data: openPositions }] =
     await Promise.all([
       employee.manager_id
-        ? supabase.from("employees_directory").select("id, first_name, last_name, job_title").eq("id", employee.manager_id).single()
+        ? supabase.from("employees").select("id, first_name, last_name, job_title").eq("id", employee.manager_id).single()
         : Promise.resolve({ data: null }),
       supabase
-        .from("employees_directory")
+        .from("employees")
         .select("id, first_name, last_name, job_title, status")
         .eq("manager_id", id)
         .order("last_name"),
@@ -46,7 +40,6 @@ export default async function EmployeeDetailPage({ params }: PageProps) {
       teams={teams ?? []}
       locations={locations ?? []}
       openPositions={openPositions ?? []}
-      canEdit={canEdit}
     />
   );
 }

app/(app)/employees/page.tsx

@@ -36,7 +36,7 @@ export default async function EmployeesPage({ searchParams }: EmployeesPageProps
   const to = from + PAGE_SIZE - 1;
 
   let query = supabase
-    .from("employees_directory")
+    .from("employees")
     .select(
       "id, first_name, last_name, personnel_number, job_title, team_id, division_id, location_id, entry_date, employment_type, weekly_hours, status",
       { count: "exact" }