Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

app/(app)/positions/page.tsx

@@ -12,9 +12,9 @@ export default async function PositionsPage() {
       supabase.from("divisions").select("*").order("name"),
       supabase.from("departments").select("*"),
       supabase.from("teams").select("*"),
-      supabase.from("employees_directory").select("team_id, division_id, weekly_hours").in("status", ["Aktiv", "Karenz"]),
+      supabase.from("employees").select("team_id, division_id, weekly_hours").in("status", ["Aktiv", "Karenz"]),
       supabase
-        .from("employees_directory")
+        .from("employees")
         .select("id, first_name, last_name, team_id, division_id, org_level, is_lead")
         .eq("status", "Aktiv")
         .or("is_lead.eq.true,org_level.eq.0"),