Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

components/hire/StepVertrag.tsx

@@ -72,10 +72,6 @@ export function StepVertrag({ draft, update }: { draft: HireDraftData; update: (
           />
         </div>
       </div>
-      <div>
-        <label className="mb-1 block text-sm font-semibold text-ink">Bruttogehalt/Monat (14x)*</label>
-        <input type="number" value={draft.salary} onChange={(e) => update({ salary: e.target.value })} className="w-full rounded border border-border px-3 py-2 text-sm" />
-      </div>
       <div>
         <label className="mb-1 block text-sm font-semibold text-ink">Paygrade*</label>
         <select