Phase 3: Hire wizard, draft resume, and two real SQL bugfixes

- components/hire/: 4-step Hire Wizard (Person/Position/Vertrag/
  Zusammenfassung) matching sec4.4, with a HireWizardProvider context so it
  can be opened both from the global "+ Neueinstellung" button and from a
  "Fortsetzen" link on a saved draft.
- actions/hireDrafts.ts: save/delete hire_drafts (owner-scoped RLS already
  in place from Phase 1). Dashboard now shows the "Entwuerfe" card the
  Phase 1 plan deferred, since the wizard it depends on now exists.
- lib/positions.ts: shared open-positions loader (position number, org
  breadcrumb, resolved manager name) used by both the wizard and (later)
  the Positions page.

Two real bugs found via live testing and fixed in supabase/functions.sql:
1. hire_employee/rehire_employee: a two-branch CASE returning bare string
   literals defaults to `text`, not the target enum, so `status = case
   when ... then 'Geplant' else 'Aktiv' end` failed against the
   employment_status column. Fixed with an explicit ::employment_status
   cast on the whole CASE expression.
2. Postgres precedence gotcha: ->> and || sit at the *same* precedence
   tier and left-associate, so `payload->>'first_name' || ' ' ||
   payload->>'last_name'` does not group the way it reads - it tries to
   apply ->> to an intermediate text value and fails with "operator does
   not exist: text ->> unknown". Fixed by parenthesizing every ->>'...'
   expression that participates in a || chain.

Also fixed: hire_employee referenced v_position.title outside the branch
that assigns v_position, raising "record not assigned" whenever a hire
wasn't tied to a position_id; extracted a v_job_title variable instead.

Verified live end-to-end: wizard search -> select position -> submit
creates the employee, closes the position, and writes matching
employee_history + audit_log rows atomically.

actions/hireDrafts.ts

@@ -0,0 +1,45 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { createClient } from "@/lib/supabase/server";
+
+type ActionResult = { success: boolean; error?: string };
+
+export async function saveHireDraft(payload: {
+  id?: string;
+  step: number;
+  data: Record<string, unknown>;
+}): Promise<ActionResult & { id?: string }> {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return { success: false, error: "Nicht angemeldet." };
+
+  if (payload.id) {
+    const { error } = await supabase
+      .from("hire_drafts")
+      .update({ step: payload.step, payload: payload.data, updated_at: new Date().toISOString() })
+      .eq("id", payload.id);
+    if (error) return { success: false, error: error.message };
+    revalidatePath("/");
+    return { success: true, id: payload.id };
+  }
+
+  const { data, error } = await supabase
+    .from("hire_drafts")
+    .insert({ created_by: user.id, step: payload.step, payload: payload.data })
+    .select("id")
+    .single();
+  if (error) return { success: false, error: error.message };
+  revalidatePath("/");
+  return { success: true, id: data.id };
+}
+
+export async function deleteHireDraft(id: string): Promise<ActionResult> {
+  const supabase = await createClient();
+  const { error } = await supabase.from("hire_drafts").delete().eq("id", id);
+  if (error) return { success: false, error: error.message };
+  revalidatePath("/");
+  return { success: true };
+}