Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

tests/unit/colors.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { actionBadgeStyle, avatarColorFor, STATUS_STYLES } from "@/lib/colors";
+
+describe("avatarColorFor", () => {
+  it("is deterministic for the same seed", () => {
+    expect(avatarColorFor("Maria Gruber")).toBe(avatarColorFor("Maria Gruber"));
+  });
+
+  it("returns a value from the fixed palette (a hex color)", () => {
+    expect(avatarColorFor("Anna Huber")).toMatch(/^#[0-9a-f]{6}$/i);
+  });
+});
+
+describe("STATUS_STYLES", () => {
+  it("has an entry for every employment status", () => {
+    expect(Object.keys(STATUS_STYLES).sort()).toEqual(["Aktiv", "Ausgetreten", "Geplant", "Karenz"].sort());
+  });
+});
+
+describe("actionBadgeStyle", () => {
+  it("maps known audit actions to their category style", () => {
+    expect(actionBadgeStyle("Austritt")).toBe(STATUS_STYLES.Ausgetreten);
+    expect(actionBadgeStyle("Neueinstellung")).toBe(STATUS_STYLES.Aktiv);
+  });
+
+  it("falls back to the brand style for an unknown action", () => {
+    expect(actionBadgeStyle("Irgendwas Unbekanntes")).toContain("bg-brand-100");
+  });
+});