Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

tests/integration/reorg.test.ts

@@ -0,0 +1,147 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createHrUser,
+  deleteTestEmployee,
+  deleteTestUser,
+  hireTestEmployee,
+  isoDateOffset,
+  pickSeededTeam,
+  signInAs,
+  teamLeadId,
+  type TestUser,
+} from "./helpers";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "@/lib/supabase/types";
+
+// Reorg scenarios: immediate apply/undo must respect employee_history's
+// append-only contract (20260714120300_reorg_undo_append_only.sql), and a
+// future-dated scenario must defer every move via pending_org_changes until
+// its effective date, flipping reorg_scenarios.applied only once every move
+// has landed (20260714120200_effective_dating_rpcs.sql).
+describe("reorg scenarios", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let teamA: { id: string };
+  let teamB: { id: string };
+  const employeeIds: string[] = [];
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    teamA = await pickSeededTeam();
+    teamB = await pickSeededTeam(teamA.id);
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function freshEmployee(teamId: string): Promise<string> {
+    const id = await hireTestEmployee(hrClient, teamId);
+    employeeIds.push(id);
+    return id;
+  }
+
+  it("applies an immediate reorg now, and undo appends a compensating history row instead of deleting", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const teamBLead = await teamLeadId(teamB.id);
+
+    const { data: scenarioId, error: applyError } = await hrClient.rpc("apply_reorg", {
+      payload: {
+        name: `Integrationstest Reorg ${employeeId.slice(0, 8)}`,
+        effective_date: isoDateOffset(0),
+        moves: [{ kind: "emp", label: "Test", employee_ids: [employeeId], target_team_id: teamB.id }],
+      },
+    });
+    expect(applyError).toBeNull();
+    expect(scenarioId).toBeTruthy();
+
+    const { data: movedEmployee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(movedEmployee?.team_id).toBe(teamB.id);
+    expect(movedEmployee?.manager_id).toBe(teamBLead);
+
+    const { data: scenario } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied, applied_at")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenario?.applied).toBe(true);
+    expect(scenario?.applied_at).not.toBeNull();
+
+    const { count: historyBeforeUndo } = await adminClient
+      .from("employee_history")
+      .select("id", { count: "exact", head: true })
+      .eq("employee_id", employeeId)
+      .eq("event_type", "Reorganisation");
+    expect(historyBeforeUndo).toBe(1);
+
+    const { error: undoError } = await hrClient.rpc("undo_reorg", { payload: { scenario_id: scenarioId } });
+    expect(undoError).toBeNull();
+
+    const { data: revertedEmployee } = await adminClient.from("employees").select("team_id").eq("id", employeeId).single();
+    expect(revertedEmployee?.team_id).toBe(teamA.id);
+
+    const { data: undoneScenario } = await adminClient.from("reorg_scenarios").select("applied").eq("id", scenarioId as string).single();
+    expect(undoneScenario?.applied).toBe(false);
+
+    // The original "Reorganisation" row must still be there — undo appends
+    // a compensating entry, it never deletes (the bug the migration fixed).
+    const { count: historyAfterUndo } = await adminClient
+      .from("employee_history")
+      .select("id", { count: "exact", head: true })
+      .eq("employee_id", employeeId)
+      .eq("event_type", "Reorganisation");
+    expect(historyAfterUndo).toBe(2);
+  });
+
+  it("defers a future-dated reorg and only flips reorg_scenarios.applied once its pending change lands", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const teamBLead = await teamLeadId(teamB.id);
+
+    const { data: scenarioId, error: applyError } = await hrClient.rpc("apply_reorg", {
+      payload: {
+        name: `Integrationstest Reorg (zukünftig) ${employeeId.slice(0, 8)}`,
+        effective_date: isoDateOffset(30),
+        moves: [{ kind: "emp", label: "Test", employee_ids: [employeeId], target_team_id: teamB.id }],
+      },
+    });
+    expect(applyError).toBeNull();
+
+    const { data: unchangedEmployee } = await adminClient.from("employees").select("team_id").eq("id", employeeId).single();
+    expect(unchangedEmployee?.team_id).toBe(teamA.id);
+
+    const { data: scenarioBefore } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenarioBefore?.applied).toBe(false);
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id")
+      .eq("employee_id", employeeId)
+      .eq("reorg_scenario_id", scenarioId as string)
+      .eq("status", "pending")
+      .single();
+    expect(pending).not.toBeNull();
+
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    const { error: cronError } = await adminClient.rpc("apply_due_pending_changes");
+    expect(cronError).toBeNull();
+
+    const { data: movedEmployee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(movedEmployee?.team_id).toBe(teamB.id);
+    expect(movedEmployee?.manager_id).toBe(teamBLead);
+
+    const { data: scenarioAfter } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied, applied_at")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenarioAfter?.applied).toBe(true);
+    expect(scenarioAfter?.applied_at).not.toBeNull();
+  });
+});