Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

components/hire/HireWizardContext.tsx

@@ -29,17 +29,24 @@ export function HireWizardProvider({
   const [open, setOpen] = useState(false);
   const [resumeDraft, setResumeDraft] = useState<HireDraft | null>(null);
   const [initialPositionId, setInitialPositionId] = useState<string | undefined>(undefined);
+  // Forces HireWizard to remount fresh each time it's opened, so its
+  // internal draft/step state is (re-)initialized directly from the current
+  // resumeDraft/initialPositionId props at mount time — no reset-on-open
+  // effect needed inside HireWizard itself.
+  const [openKey, setOpenKey] = useState(0);
 
   function openWizard(options?: OpenWizardOptions) {
     setResumeDraft(options?.draftId ? (drafts.find((d) => d.id === options.draftId) ?? null) : null);
     setInitialPositionId(options?.positionId);
     setOpen(true);
+    setOpenKey((k) => k + 1);
   }
 
   return (
     <HireWizardContext.Provider value={{ openWizard }}>
       {children}
       <HireWizard
+        key={openKey}
         open={open}
         onClose={() => setOpen(false)}
         openPositions={openPositions}