Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

tests/unit/org.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { breadcrumbFor, breadcrumbLabel, type OrgMaps } from "@/lib/org";
+import type { Database } from "@/lib/supabase/types";
+
+type Division = Database["public"]["Tables"]["divisions"]["Row"];
+type Department = Database["public"]["Tables"]["departments"]["Row"];
+type Team = Database["public"]["Tables"]["teams"]["Row"];
+type Location = Database["public"]["Tables"]["locations"]["Row"];
+
+const division: Division = { id: "div-1", org_number: "20100000", name: "Produktion" };
+const department: Department = { id: "dept-1", org_number: "21100000", name: "Fertigung", division_id: "div-1" };
+const team: Team = { id: "team-1", org_number: "22010000", name: "Montage", department_id: "dept-1" };
+const location: Location = { id: "loc-1", name: "Wien-Hernals", country: "Österreich" };
+
+const orgMaps: OrgMaps = {
+  divisions: new Map([[division.id, division]]),
+  departments: new Map([[department.id, department]]),
+  teams: new Map([[team.id, team]]),
+  locations: new Map([[location.id, location]]),
+  divisionList: [division],
+  locationList: [location],
+};
+
+describe("breadcrumbFor", () => {
+  it("resolves division, department (via team), and team from ids", () => {
+    const result = breadcrumbFor(orgMaps, division.id, team.id);
+    expect(result.division?.name).toBe("Produktion");
+    expect(result.department?.name).toBe("Fertigung");
+    expect(result.team?.name).toBe("Montage");
+  });
+
+  it("has no team/department for a division head with no team (team_id null)", () => {
+    const result = breadcrumbFor(orgMaps, division.id, null);
+    expect(result.division?.name).toBe("Produktion");
+    expect(result.team).toBeUndefined();
+    expect(result.department).toBeUndefined();
+  });
+});
+
+describe("breadcrumbLabel", () => {
+  it("joins division › department › team with the SAP-OM breadcrumb separator", () => {
+    expect(breadcrumbLabel(orgMaps, division.id, team.id)).toBe("Produktion › Fertigung › Montage");
+  });
+
+  it("omits missing segments instead of producing empty separators", () => {
+    expect(breadcrumbLabel(orgMaps, division.id, null)).toBe("Produktion");
+  });
+
+  it("falls back to a dash when nothing resolves", () => {
+    expect(breadcrumbLabel(orgMaps, null, null)).toBe("–");
+  });
+});