feat: initialize ERP base platform (extracted from HMS)

- Stripped 11 business crates (health, ai, dialysis, plugins)
- Cleaned AppState, AppConfig, main.rs from business coupling
- Reduced migrations from 169 to 53 (base-only)
- Removed health_provider trait from erp-core
- Removed business integration tests
- Removed gateway rate limiting middleware
- Base capabilities: auth, RBAC, JWT, config, workflow, message, plugin, audit, crypto, RLS, multi-tenant

Cargo check: OK
Cargo test: OK

apps/web/e2e/auth.fixture.ts

@@ -0,0 +1,43 @@
+import { test as base } from '@playwright/test';
+
+const API_BASE = 'http://localhost:3000/api/v1';
+
+let loginPromise: Promise<{ token: string; user: unknown }> | null = null;
+
+function login(): Promise<{ token: string; user: unknown }> {
+  if (!loginPromise) {
+    loginPromise = (async () => {
+      for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+          const res = await fetch(`${API_BASE}/auth/login`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ username: 'admin', password: 'Admin@2026' }),
+          });
+          const json = await res.json();
+          if (json.success) {
+            return { token: json.data.access_token, user: json.data.user };
+          }
+        } catch {}
+        // Wait before retry on collision
+        await new Promise((r) => setTimeout(r, 500 * (attempt + 1)));
+      }
+      throw new Error('Login failed after 3 attempts');
+    })();
+  }
+  return loginPromise;
+}
+
+export const test = base.extend({
+  page: async ({ page }, use) => {
+    const { token, user } = await login();
+    await page.addInitScript((args) => {
+      localStorage.setItem('access_token', args.token);
+      localStorage.setItem('refresh_token', args.token);
+      localStorage.setItem('user', JSON.stringify(args.user));
+    }, { token, user });
+    await use(page);
+  },
+});
+
+export { expect } from '@playwright/test';