Phase 1: project foundation for Alpenwerk HR

Scaffolds the Next.js 16 / TypeScript strict / Tailwind v3 app per
NEXTJS_REBUILD_SUPERPROMPT.md, and implements the Foundation slice from
the Phase 1 plan:

- Corrected Supabase schema (supabase/schema.sql): org units, employees,
  history, positions, hire drafts, saved reports, audit log, reorg
  scenarios, role-based profiles, salary-masking view, RLS policies,
  auto-derivation triggers, position-number generator.
- Seed script (supabase/seed.ts): ~800 realistic Austrian employees across
  9 divisions / 16 departments / 35 teams, history, 8 open positions, and
  hr_admin/manager test accounts.
- Supabase clients (lib/supabase/*), design tokens (tailwind.config.ts),
  format/color helpers (lib/format.ts, lib/colors.ts).
- Shared UI kit (components/ui): Avatar, StatusChip, Toast, Modal,
  SlideOver, SegmentedControl, Lookup.
- Auth (login page, Server Actions) and proxy.ts (Next 16's replacement
  for middleware) guarding the authenticated route group.
- Shell (Sidebar, Topbar, NewHireButton stub) and the Dashboard page,
  reading live data via employees_directory.

Employees list/detail, hire wizard, action panels, org chart, positions,
reports, and audit log are deferred to later phases per the plan.

lib/supabase/admin.ts

@@ -0,0 +1,16 @@
+import { createClient as createSupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "./types";
+
+// Service-role client: bypasses RLS entirely. Server-only — never import this
+// from a Client Component or anything bundled for the browser.
+export function createAdminClient() {
+  if (typeof window !== "undefined") {
+    throw new Error("createAdminClient must never be called in the browser");
+  }
+
+  return createSupabaseClient<Database>(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.SUPABASE_SERVICE_ROLE_KEY!,
+    { auth: { autoRefreshToken: false, persistSession: false } }
+  );
+}

lib/supabase/client.ts

@@ -0,0 +1,11 @@
+import { createBrowserClient } from "@supabase/ssr";
+import type { Database } from "./types";
+
+// For use in Client Components that need interactivity (filters, live
+// hints, etc). Server Components/Actions should use lib/supabase/server.ts.
+export function createClient() {
+  return createBrowserClient<Database>(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
+  );
+}

lib/supabase/server.ts

@@ -0,0 +1,31 @@
+import { createServerClient } from "@supabase/ssr";
+import { cookies } from "next/headers";
+import type { Database } from "./types";
+
+// For use in Server Components and Server Actions. Respects the signed-in
+// user's session, so all reads/writes go through RLS as that user.
+export async function createClient() {
+  const cookieStore = await cookies();
+
+  return createServerClient<Database>(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return cookieStore.getAll();
+        },
+        setAll(cookiesToSet) {
+          try {
+            cookiesToSet.forEach(({ name, value, options }) =>
+              cookieStore.set(name, value, options)
+            );
+          } catch {
+            // Called from a Server Component during render — safe to ignore
+            // because proxy.ts refreshes the session cookie on every request.
+          }
+        },
+      },
+    }
+  );
+}

lib/supabase/types.ts

@@ -0,0 +1,286 @@
+// Hand-written to match supabase/schema.sql (no DB connection string available to
+// run `supabase gen types typescript` in this environment — regenerate from the
+// live project once you have the Supabase CLI linked).
+
+export type EmploymentStatus = "Aktiv" | "Karenz" | "Geplant" | "Ausgetreten";
+export type EmploymentType = "Vollzeit" | "Teilzeit";
+export type ContractType = "unbefristet" | "befristet";
+export type PaygradeType = "A" | "B" | "C" | "D" | "E" | "F";
+export type SourceType = "Intern" | "Extern";
+export type GenderType = "m" | "w";
+export type ProfileRole = "hr_admin" | "manager";
+export type HistoryEventType =
+  | "Eintritt"
+  | "Beförderung"
+  | "Versetzung"
+  | "Karenz"
+  | "Vertragsänderung"
+  | "Stammdatenänderung"
+  | "Austritt"
+  | "Wiedereintritt"
+  | "Reorganisation"
+  | "Gehaltsanpassung"
+  | "Rückkehr";
+export type PositionStatus = "open" | "filled";
+export type ReorgMoveKind = "emp" | "team" | "abt" | "dept";
+
+// @supabase/postgrest-js requires every table/view to carry a Relationships
+// array (used for typed embedded selects) — left empty since no code in this
+// app relies on nested/embedded resource selects.
+type NoRelationships = { Relationships: [] };
+
+export type Database = {
+  public: {
+    Tables: {
+      divisions: NoRelationships & {
+        Row: { id: string; org_number: string; name: string };
+        Insert: { id?: string; org_number: string; name: string };
+        Update: Partial<{ id: string; org_number: string; name: string }>;
+      };
+      departments: NoRelationships & {
+        Row: { id: string; org_number: string; name: string; division_id: string };
+        Insert: { id?: string; org_number: string; name: string; division_id: string };
+        Update: Partial<{ id: string; org_number: string; name: string; division_id: string }>;
+      };
+      teams: NoRelationships & {
+        Row: { id: string; org_number: string; name: string; department_id: string };
+        Insert: { id?: string; org_number: string; name: string; department_id: string };
+        Update: Partial<{ id: string; org_number: string; name: string; department_id: string }>;
+      };
+      locations: NoRelationships & {
+        Row: { id: string; name: string; country: string };
+        Insert: { id?: string; name: string; country: string };
+        Update: Partial<{ id: string; name: string; country: string }>;
+      };
+      profiles: NoRelationships & {
+        Row: { id: string; email: string; full_name: string | null; role: ProfileRole; created_at: string };
+        Insert: { id: string; email: string; full_name?: string | null; role?: ProfileRole; created_at?: string };
+        Update: Partial<{ id: string; email: string; full_name: string | null; role: ProfileRole; created_at: string }>;
+      };
+      employees: NoRelationships & {
+        Row: {
+          id: string;
+          personnel_number: number;
+          first_name: string;
+          last_name: string;
+          gender: GenderType;
+          birth_date: string;
+          sv_nummer: string | null;
+          nationality: string;
+          address: string | null;
+          address_country: string | null;
+          email: string;
+          phone: string | null;
+          team_id: string | null;
+          division_id: string;
+          job_title: string;
+          location_id: string;
+          manager_id: string | null;
+          org_level: number;
+          is_lead: boolean;
+          employment_type: EmploymentType;
+          weekly_hours: number;
+          monthly_salary_gross: number;
+          contract_type: ContractType;
+          contract_end_date: string | null;
+          paygrade: PaygradeType;
+          source: SourceType;
+          status: EmploymentStatus;
+          entry_date: string;
+          exit_date: string | null;
+          exit_reason: string | null;
+          karenz_return_date: string | null;
+          avatar_color: string | null;
+          created_at: string;
+          updated_at: string;
+        };
+        Insert: {
+          id?: string;
+          first_name: string;
+          last_name: string;
+          gender: GenderType;
+          birth_date: string;
+          sv_nummer?: string | null;
+          nationality?: string;
+          address?: string | null;
+          address_country?: string | null;
+          email: string;
+          phone?: string | null;
+          team_id?: string | null;
+          division_id?: string;
+          job_title: string;
+          location_id: string;
+          manager_id?: string | null;
+          org_level?: number;
+          is_lead?: boolean;
+          employment_type?: EmploymentType;
+          weekly_hours?: number;
+          monthly_salary_gross: number;
+          contract_type?: ContractType;
+          contract_end_date?: string | null;
+          paygrade?: PaygradeType;
+          source?: SourceType;
+          status?: EmploymentStatus;
+          entry_date: string;
+          exit_date?: string | null;
+          exit_reason?: string | null;
+          karenz_return_date?: string | null;
+          avatar_color?: string | null;
+          created_at?: string;
+          updated_at?: string;
+        };
+        Update: Partial<Database["public"]["Tables"]["employees"]["Insert"]>;
+      };
+      employee_history: NoRelationships & {
+        Row: {
+          id: string;
+          employee_id: string;
+          event_date: string;
+          event_type: HistoryEventType;
+          description: string;
+          created_at: string;
+        };
+        Insert: {
+          id?: string;
+          employee_id: string;
+          event_date: string;
+          event_type: HistoryEventType;
+          description: string;
+          created_at?: string;
+        };
+        Update: Partial<Database["public"]["Tables"]["employee_history"]["Insert"]>;
+      };
+      positions: NoRelationships & {
+        Row: {
+          id: string;
+          position_number: string;
+          title: string;
+          team_id: string;
+          division_id: string;
+          is_lead: boolean;
+          reports_to_employee_id: string | null;
+          status: PositionStatus;
+          created_at: string;
+          filled_at: string | null;
+          filled_by_employee_id: string | null;
+        };
+        Insert: {
+          id?: string;
+          position_number?: string;
+          title: string;
+          team_id: string;
+          division_id?: string;
+          is_lead?: boolean;
+          reports_to_employee_id?: string | null;
+          status?: PositionStatus;
+          created_at?: string;
+          filled_at?: string | null;
+          filled_by_employee_id?: string | null;
+        };
+        Update: Partial<Database["public"]["Tables"]["positions"]["Insert"]>;
+      };
+      hire_drafts: NoRelationships & {
+        Row: { id: string; created_by: string | null; step: number; payload: Record<string, unknown>; updated_at: string };
+        Insert: { id?: string; created_by?: string | null; step?: number; payload: Record<string, unknown>; updated_at?: string };
+        Update: Partial<Database["public"]["Tables"]["hire_drafts"]["Insert"]>;
+      };
+      saved_reports: NoRelationships & {
+        Row: { id: string; created_by: string | null; name: string; config: Record<string, unknown>; created_at: string };
+        Insert: { id?: string; created_by?: string | null; name: string; config: Record<string, unknown>; created_at?: string };
+        Update: Partial<Database["public"]["Tables"]["saved_reports"]["Insert"]>;
+      };
+      audit_log: NoRelationships & {
+        Row: {
+          id: string;
+          occurred_at: string;
+          actor_user_id: string | null;
+          actor_name: string;
+          action: string;
+          target_label: string;
+          target_employee_id: string | null;
+          details: string | null;
+        };
+        Insert: {
+          id?: string;
+          occurred_at?: string;
+          actor_user_id?: string | null;
+          actor_name: string;
+          action: string;
+          target_label: string;
+          target_employee_id?: string | null;
+          details?: string | null;
+        };
+        Update: Partial<Database["public"]["Tables"]["audit_log"]["Insert"]>;
+      };
+      reorg_scenarios: NoRelationships & {
+        Row: {
+          id: string;
+          name: string;
+          effective_date: string;
+          created_by: string | null;
+          applied: boolean;
+          applied_at: string | null;
+          undo_snapshot: Record<string, unknown> | null;
+          created_at: string;
+        };
+        Insert: {
+          id?: string;
+          name: string;
+          effective_date: string;
+          created_by?: string | null;
+          applied?: boolean;
+          applied_at?: string | null;
+          undo_snapshot?: Record<string, unknown> | null;
+          created_at?: string;
+        };
+        Update: Partial<Database["public"]["Tables"]["reorg_scenarios"]["Insert"]>;
+      };
+      reorg_moves: NoRelationships & {
+        Row: { id: string; scenario_id: string; kind: ReorgMoveKind; payload: Record<string, unknown> };
+        Insert: { id?: string; scenario_id: string; kind: ReorgMoveKind; payload: Record<string, unknown> };
+        Update: Partial<Database["public"]["Tables"]["reorg_moves"]["Insert"]>;
+      };
+    };
+    Views: {
+      employees_directory: NoRelationships & {
+        Row: {
+          id: string;
+          personnel_number: number;
+          first_name: string;
+          last_name: string;
+          gender: GenderType;
+          birth_date: string;
+          sv_nummer: string | null;
+          nationality: string;
+          address: string | null;
+          address_country: string | null;
+          email: string;
+          phone: string | null;
+          team_id: string | null;
+          division_id: string;
+          job_title: string;
+          location_id: string;
+          manager_id: string | null;
+          org_level: number;
+          is_lead: boolean;
+          employment_type: EmploymentType;
+          weekly_hours: number;
+          monthly_salary_gross: number | null; // masked to null for non-admin sessions
+          contract_type: ContractType;
+          contract_end_date: string | null;
+          paygrade: PaygradeType;
+          source: SourceType;
+          status: EmploymentStatus;
+          entry_date: string;
+          exit_date: string | null;
+          exit_reason: string | null;
+          karenz_return_date: string | null;
+          avatar_color: string | null;
+          created_at: string;
+          updated_at: string;
+        };
+      };
+    };
+    Functions: Record<string, never>;
+  };
+};