feat(config): add system configuration module (Phase 3)

Implement the complete erp-config crate with:
- Data dictionaries (CRUD + items management)
- Dynamic menus (tree structure with role filtering)
- System settings (hierarchical: platform > tenant > org > user)
- Numbering rules (concurrency-safe via PostgreSQL advisory_lock)
- Theme and language configuration (via settings store)
- 6 database migrations (dictionaries, menus, settings, numbering_rules)
- Frontend Settings page with 5 tabs (dictionary, menu, numbering, settings, theme)

Refactor: move RBAC functions (require_permission) from erp-auth to erp-core
to avoid cross-module dependencies.

Add 20 new seed permissions for config module operations.

crates/erp-config/src/handler/menu_handler.rs

@@ -0,0 +1,104 @@
+use axum::Extension;
+use axum::extract::{FromRef, Json, State};
+use axum::response::Json as JsonResponse;
+use validator::Validate;
+
+use erp_core::error::AppError;
+use erp_core::rbac::require_permission;
+use erp_core::types::{ApiResponse, TenantContext};
+use uuid::Uuid;
+
+use crate::config_state::ConfigState;
+use crate::dto::{BatchSaveMenusReq, CreateMenuReq, MenuResp};
+use crate::service::menu_service::MenuService;
+
+/// GET /api/v1/menus
+///
+/// 获取当前租户下当前用户角色可见的菜单树。
+/// 根据用户关联的角色过滤菜单可见性。
+/// 需要 `menu.list` 权限。
+pub async fn get_menus<S>(
+    State(state): State<ConfigState>,
+    Extension(ctx): Extension<TenantContext>,
+) -> Result<JsonResponse<ApiResponse<Vec<MenuResp>>>, AppError>
+where
+    ConfigState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "menu.list")?;
+
+    let role_ids: Vec<Uuid> = ctx
+        .roles
+        .iter()
+        .filter_map(|r| Uuid::parse_str(r).ok())
+        .collect();
+
+    let menus = MenuService::get_menu_tree(ctx.tenant_id, &role_ids, &state.db).await?;
+
+    Ok(JsonResponse(ApiResponse::ok(menus)))
+}
+
+/// PUT /api/v1/menus/batch
+///
+/// 批量保存菜单列表。
+/// 对每个菜单项：有 id 的执行更新，没有 id 的执行创建。
+/// 需要 `menu.update` 权限。
+pub async fn batch_save_menus<S>(
+    State(state): State<ConfigState>,
+    Extension(ctx): Extension<TenantContext>,
+    Json(req): Json<BatchSaveMenusReq>,
+) -> Result<JsonResponse<ApiResponse<()>>, AppError>
+where
+    ConfigState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "menu.update")?;
+
+    req.validate()
+        .map_err(|e| AppError::Validation(e.to_string()))?;
+
+    for item in &req.menus {
+        match item.id {
+            Some(id) => {
+                let update_req = crate::dto::UpdateMenuReq {
+                    title: Some(item.title.clone()),
+                    path: item.path.clone(),
+                    icon: item.icon.clone(),
+                    sort_order: item.sort_order,
+                    visible: item.visible,
+                    permission: item.permission.clone(),
+                    role_ids: item.role_ids.clone(),
+                };
+                MenuService::update(id, ctx.tenant_id, ctx.user_id, &update_req, &state.db)
+                    .await?;
+            }
+            None => {
+                let create_req = CreateMenuReq {
+                    parent_id: item.parent_id,
+                    title: item.title.clone(),
+                    path: item.path.clone(),
+                    icon: item.icon.clone(),
+                    sort_order: item.sort_order,
+                    visible: item.visible,
+                    menu_type: item.menu_type.clone(),
+                    permission: item.permission.clone(),
+                    role_ids: item.role_ids.clone(),
+                };
+                MenuService::create(
+                    ctx.tenant_id,
+                    ctx.user_id,
+                    &create_req,
+                    &state.db,
+                    &state.event_bus,
+                )
+                .await?;
+            }
+        }
+    }
+
+    Ok(JsonResponse(ApiResponse {
+        success: true,
+        data: None,
+        message: Some("菜单批量保存成功".to_string()),
+    }))
+}