Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

app/api/cron/apply-pending-changes/route.ts

@@ -0,0 +1,24 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { createAdminClient } from "@/lib/supabase/admin";
+
+// Applies effective-dated changes (Versetzung/Beförderung/Karenz/Reorg/Daten
+// ändern with a future "Wirksam ab" date) once their date has arrived — see
+// apply_due_pending_changes() in supabase/migrations. Runs as a Vercel Cron
+// job (see vercel.json), not on behalf of any HR user, so it authenticates
+// via a shared secret rather than a Supabase session and uses the
+// service-role client (the one legitimate server-only use case for it).
+export async function GET(request: NextRequest) {
+  const authHeader = request.headers.get("authorization");
+  if (!process.env.CRON_SECRET || authHeader !== `Bearer ${process.env.CRON_SECRET}`) {
+    return NextResponse.json({ error: "Nicht autorisiert." }, { status: 401 });
+  }
+
+  const supabase = createAdminClient();
+  const { data, error } = await supabase.rpc("apply_due_pending_changes");
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json({ applied: data });
+}