Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

supabase/migrations/20260714120500_default_grants.sql

@@ -0,0 +1,25 @@
+-- Explicit schema/table/sequence/routine grants for anon/authenticated/
+-- service_role.
+--
+-- Found while standing up a local Supabase instance to run the integration
+-- test suite (spec §17): every table in this schema
+-- relies on RLS policies to restrict access, but RLS only ever *narrows*
+-- what an already-GRANTed role may do — Postgres still checks ordinary
+-- object privileges first, independent of a role's BYPASSRLS flag. On
+-- Supabase's hosted platform this GRANT setup is applied automatically
+-- during project provisioning, so it was invisible here: every previous
+-- migration worked fine against the already-provisioned hosted project, but
+-- the exact same migrations against a *fresh* Postgres (a new local dev
+-- instance, a disaster-recovery restore, or CI) fail with "permission
+-- denied for table X" even for the service role, since that grant was never
+-- actually part of this repo's own migrations. Making it explicit here
+-- makes the schema fully self-contained and reprovisionable from scratch.
+grant usage on schema public to anon, authenticated, service_role;
+
+grant all on all tables in schema public to anon, authenticated, service_role;
+grant all on all sequences in schema public to anon, authenticated, service_role;
+grant all on all routines in schema public to anon, authenticated, service_role;
+
+alter default privileges in schema public grant all on tables to anon, authenticated, service_role;
+alter default privileges in schema public grant all on sequences to anon, authenticated, service_role;
+alter default privileges in schema public grant all on routines to anon, authenticated, service_role;