Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

components/reports/ReportsPageClient.tsx

@@ -39,7 +39,6 @@ type ReportsPageClientProps = {
 function formatValue(measure: Measure, value: number): string {
   if (["headcount", "hires", "exits"].includes(measure)) return String(Math.round(value));
   if (measure === "fte") return value.toFixed(1);
-  if (measure === "avg_salary") return new Intl.NumberFormat("de-AT", { style: "currency", currency: "EUR" }).format(value);
   if (measure === "parttime_rate" || measure === "female_share") return `${value.toFixed(1)}%`;
   if (measure === "avg_age" || measure === "avg_tenure") return `${value.toFixed(1)} Jahre`;
   return value.toFixed(1);