Make the cut-over script safe to paste, and record the Azure design

The mapping table was declared ON COMMIT DROP. In the Supabase SQL editor
the transaction boundaries are not ours to assume, and a mapping table that
vanished between the two inserts would leave positions without assignments
and be miserable to diagnose. It is now dropped explicitly once both inserts
have run.

docs/azure-migration.md is the design for the Azure move, for review before
any code changes.

Its main finding corrects what I said when I laid out the options: I claimed
that dropping Supabase would push the security boundary into application
code. It does not. auth.uid() appears 70 times, but only one of them matters
— inside is_hr_user(), which all 58 policies call. Swapping the source of
the user id there leaves every policy valid, so the database stays the
boundary.

The risk moves elsewhere, and the design says so plainly: the user id
arrives via set_config(..., true), which is transaction-local. Outside a
transaction it sticks to the pooled connection, and the next request on that
connection runs as the previous user. So the plan makes that structurally
impossible — a single access function that owns the transaction, a lint rule
against importing the pool anywhere else, a database role without BYPASSRLS
so a missing context returns nothing rather than everything, and a test that
sends two requests over one pooled connection to prove the second cannot see
the first.

supabase/migrations/20260727120200_om_cutover.sql

@@ -70,11 +70,14 @@ on conflict (title) do nothing;
 -- beiden Inserts benutzt. Zwei unabhängig berechnete Fensterfunktionen
 -- wären hier die klassische Fehlerquelle: sie sehen gleich aus und ordnen
 -- doch verschieden.
+-- Kein "on commit drop": im SQL-Editor hängt es vom Transaktionsverhalten
+-- ab, wann das greift, und eine zu früh verschwundene Zuordnungstabelle
+-- wäre schwer zu diagnostizieren. Wird am Ende explizit entfernt.
 create temporary table om_pos_map (
   employee_id uuid primary key,
   position_id uuid not null default gen_random_uuid(),
   seq bigint
-) on commit drop;
+);
 
 insert into om_pos_map (employee_id, seq)
 select id, row_number() over (order by org_level, personnel_number) from employees;
@@ -154,6 +157,8 @@ begin
   end if;
 end $$;
 
+drop table om_pos_map;
+
 -- ═══ 4. Altmodell entfernen ══════════════════════════════════════
 
 -- Vorgemerkte Änderungen verweisen über team_id auf das Altmodell. Sie sind