Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

components/hire/StepSummary.tsx

@@ -1,4 +1,4 @@
-import { fmtDate, fmtEUR } from "@/lib/format";
+import { fmtDate } from "@/lib/format";
 import type { OpenPositionResolved } from "@/lib/positions";
 import type { HireDraftData } from "./types";
 
@@ -34,7 +34,6 @@ export function StepSummary({ draft, selectedPosition, locations }: StepSummaryP
     ["Eintrittsdatum", fmtDate(draft.entryDate)],
     ["Vertragsart", draft.contractType === "befristet" ? `befristet bis ${fmtDate(draft.contractEndDate)}` : "unbefristet"],
     ["Beschäftigungsausmaß", `${draft.employmentType} (${draft.weeklyHours} h)`],
-    ["Bruttogehalt (14x/Jahr)", fmtEUR(Number(draft.salary))],
     ["Paygrade", PAYGRADE_LABELS[draft.paygrade]],
   ];