Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

lib/positions.ts

@@ -28,7 +28,7 @@ export async function loadOpenPositions(supabase: SupabaseClient<Database>): Pro
     new Set((positions ?? []).map((p) => p.reports_to_employee_id).filter((id): id is string => Boolean(id)))
   );
   const { data: managers } = managerIds.length
-    ? await supabase.from("employees_directory").select("id, first_name, last_name").in("id", managerIds)
+    ? await supabase.from("employees").select("id, first_name, last_name").in("id", managerIds)
     : { data: [] as { id: string; first_name: string; last_name: string }[] };
   const managerNameById = new Map((managers ?? []).map((m) => [m.id, `${m.first_name} ${m.last_name}`]));