Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.
Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).
Bumped React, Supabase JS, and type packages to latest patch/minor releases.
Migrated the Tailwind pipeline from the v3 JS-config format to v4's CSS-first
@theme setup (@tailwindcss/postcss, @import "tailwindcss" in globals.css),
removing tailwind.config.ts and autoprefixer since v4 handles both natively.
All existing color/radius/font tokens were ported 1:1 so no component classes
needed to change. TypeScript and ESLint were bumped and tested against their
true latest majors (7.x and 10.x) but both broke the build/lint pipeline, so
they're pinned to the latest working minor instead (TypeScript 5.9.3, ESLint
9.39.5).
