Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

supabase/migrations/20260601000100_nationality_country_free_text.sql

@@ -0,0 +1,11 @@
+-- Addendum to supabase/schema.sql — run after that file.
+--
+-- Staatsbürgerschaft and Wohnland now use a searchable picker over the
+-- full UN member states list (193 countries, see lib/countries.ts)
+-- instead of the original ~9/5-value picklists. The old CHECK constraints
+-- would reject nearly all of those values, so they're dropped here. The
+-- app is the source of truth for valid values (same approach the rest of
+-- the app already relies on for large open-ended pickers); the columns
+-- stay plain text (nationality keeps its NOT NULL).
+alter table employees drop constraint if exists employees_nationality_check;
+alter table employees drop constraint if exists employees_address_country_check;