Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

app/(auth)/login/page.tsx

@@ -1,4 +1,4 @@
-import { login } from "@/actions/auth";
+import { login, logout } from "@/actions/auth";
 
 type LoginPageProps = {
   searchParams: Promise<{ error?: string }>;
@@ -16,6 +16,11 @@ export default async function LoginPage({ searchParams }: LoginPageProps) {
         {error && (
           <div role="alert" className="mt-4 rounded bg-danger-bg px-3 py-2 text-sm text-danger-text">
             {error}
+            <form action={logout} className="mt-2">
+              <button type="submit" className="text-xs font-semibold underline hover:no-underline">
+                Abmelden und mit anderem Konto versuchen
+              </button>
+            </form>
           </div>
         )}