Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

components/shell/Topbar.tsx

@@ -22,21 +22,18 @@ function titleFor(pathname: string): string {
 
 type TopbarProps = {
   userLabel: string;
-  role?: string;
-  canEdit: boolean;
 };
 
-export function Topbar({ userLabel, role, canEdit }: TopbarProps) {
+export function Topbar({ userLabel }: TopbarProps) {
   const pathname = usePathname();
 
   return (
     <header className="flex h-14 items-center justify-between border-b border-border bg-white px-6">
       <h1 className="text-base font-bold text-ink">{titleFor(pathname)}</h1>
       <div className="flex items-center gap-4">
-        {canEdit && <NewHireButton />}
+        <NewHireButton />
         <div className="flex items-center gap-2 border-l border-border pl-4 text-sm">
           <span className="font-semibold text-ink">{userLabel}</span>
-          {role && <span className="text-xs text-ink-muted">({role === "hr_admin" ? "HR-Admin" : "Manager"})</span>}
           <form action={logout}>
             <button type="submit" aria-label="Abmelden" className="ml-2 rounded p-1.5 text-ink-muted hover:bg-surface">
               <LogOut className="h-4 w-4" />