Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

supabase/migrations/20260601000500_change_employee_data_effective_date.sql

@@ -0,0 +1,71 @@
+-- Addendum to supabase/functions.sql — run after that file (and functions_2/3.sql).
+--
+-- "Daten ändern" had no "Wirksam ab" field, unlike Versetzung/Beförderung/
+-- Karenz — every change was silently logged with today's date regardless
+-- of when it should actually take effect. Adds an effective_date input
+-- (defaults to today if omitted) used for both the history event_date and
+-- noted in the change description.
+create or replace function change_employee_data(payload jsonb)
+returns void language plpgsql as $$
+declare
+  v_employee_id uuid := (payload->>'employee_id')::uuid;
+  v_effective_date date := coalesce(nullif(payload->>'effective_date', '')::date, current_date);
+  v_old employees%rowtype;
+  v_name text;
+  v_person_changes text[] := '{}';
+  v_contract_changes text[] := '{}';
+  v_person jsonb := payload->'person';
+  v_contract jsonb := payload->'contract';
+begin
+  perform require_hr_admin();
+  select * into v_old from employees where id = v_employee_id;
+  v_name := v_old.first_name || ' ' || v_old.last_name;
+
+  if v_person ? 'first_name' and (v_person->>'first_name') <> v_old.first_name then v_person_changes := array_append(v_person_changes, 'Vorname'); end if;
+  if v_person ? 'last_name' and (v_person->>'last_name') <> v_old.last_name then v_person_changes := array_append(v_person_changes, 'Nachname'); end if;
+  if v_person ? 'gender' and (v_person->>'gender') <> v_old.gender::text then v_person_changes := array_append(v_person_changes, 'Geschlecht'); end if;
+  if v_person ? 'birth_date' and (v_person->>'birth_date')::date <> v_old.birth_date then v_person_changes := array_append(v_person_changes, 'Geburtsdatum'); end if;
+  if v_person ? 'sv_nummer' and coalesce(v_person->>'sv_nummer','') <> coalesce(v_old.sv_nummer,'') then v_person_changes := array_append(v_person_changes, 'SV-Nummer'); end if;
+  if v_person ? 'nationality' and (v_person->>'nationality') <> v_old.nationality then v_person_changes := array_append(v_person_changes, 'Staatsbürgerschaft'); end if;
+  if v_person ? 'address' and coalesce(v_person->>'address','') <> coalesce(v_old.address,'') then v_person_changes := array_append(v_person_changes, 'Adresse'); end if;
+  if v_person ? 'address_country' and coalesce(v_person->>'address_country','') <> coalesce(v_old.address_country,'') then v_person_changes := array_append(v_person_changes, 'Land'); end if;
+  if v_person ? 'email' and (v_person->>'email') <> v_old.email then v_person_changes := array_append(v_person_changes, 'E-Mail'); end if;
+  if v_person ? 'phone' and coalesce(v_person->>'phone','') <> coalesce(v_old.phone,'') then v_person_changes := array_append(v_person_changes, 'Telefon'); end if;
+
+  if v_contract ? 'employment_type' and (v_contract->>'employment_type') <> v_old.employment_type::text then v_contract_changes := array_append(v_contract_changes, 'Beschäftigungsausmaß'); end if;
+  if v_contract ? 'weekly_hours' and (v_contract->>'weekly_hours')::numeric <> v_old.weekly_hours then v_contract_changes := array_append(v_contract_changes, 'Wochenstunden'); end if;
+  if v_contract ? 'contract_type' and (v_contract->>'contract_type') <> v_old.contract_type::text then v_contract_changes := array_append(v_contract_changes, 'Vertragsart'); end if;
+  if v_contract ? 'contract_end_date' and coalesce(nullif(v_contract->>'contract_end_date','')::date::text,'') <> coalesce(v_old.contract_end_date::text,'') then v_contract_changes := array_append(v_contract_changes, 'Befristet bis'); end if;
+
+  update employees set
+    first_name = coalesce(v_person->>'first_name', first_name),
+    last_name = coalesce(v_person->>'last_name', last_name),
+    gender = coalesce((v_person->>'gender')::gender_type, gender),
+    birth_date = coalesce((v_person->>'birth_date')::date, birth_date),
+    sv_nummer = coalesce(v_person->>'sv_nummer', sv_nummer),
+    nationality = coalesce(v_person->>'nationality', nationality),
+    address = coalesce(v_person->>'address', address),
+    address_country = coalesce(v_person->>'address_country', address_country),
+    email = coalesce(v_person->>'email', email),
+    phone = coalesce(v_person->>'phone', phone),
+    employment_type = coalesce((v_contract->>'employment_type')::employment_type, employment_type),
+    weekly_hours = coalesce((v_contract->>'weekly_hours')::numeric, weekly_hours),
+    contract_type = coalesce((v_contract->>'contract_type')::contract_type, contract_type),
+    contract_end_date = case when v_contract ? 'contract_end_date' then nullif(v_contract->>'contract_end_date','')::date else contract_end_date end
+  where id = v_employee_id;
+
+  if array_length(v_person_changes, 1) > 0 then
+    insert into employee_history (employee_id, event_date, event_type, description)
+      values (v_employee_id, v_effective_date, 'Stammdatenänderung', 'Geänderte Felder: ' || array_to_string(v_person_changes, ', ') || ', wirksam ab ' || v_effective_date);
+    insert into audit_log (actor_user_id, actor_name, action, target_label, target_employee_id, details)
+      values (auth.uid(), current_actor_name(), 'Stammdatenänderung', v_name, v_employee_id, array_to_string(v_person_changes, ', ') || ', wirksam ab ' || v_effective_date);
+  end if;
+
+  if array_length(v_contract_changes, 1) > 0 then
+    insert into employee_history (employee_id, event_date, event_type, description)
+      values (v_employee_id, v_effective_date, 'Vertragsänderung', 'Geänderte Felder: ' || array_to_string(v_contract_changes, ', ') || ', wirksam ab ' || v_effective_date);
+    insert into audit_log (actor_user_id, actor_name, action, target_label, target_employee_id, details)
+      values (auth.uid(), current_actor_name(), 'Vertragsänderung', v_name, v_employee_id, array_to_string(v_contract_changes, ', ') || ', wirksam ab ' || v_effective_date);
+  end if;
+end;
+$$;