feat(config): add system configuration module (Phase 3)

Implement the complete erp-config crate with:
- Data dictionaries (CRUD + items management)
- Dynamic menus (tree structure with role filtering)
- System settings (hierarchical: platform > tenant > org > user)
- Numbering rules (concurrency-safe via PostgreSQL advisory_lock)
- Theme and language configuration (via settings store)
- 6 database migrations (dictionaries, menus, settings, numbering_rules)
- Frontend Settings page with 5 tabs (dictionary, menu, numbering, settings, theme)

Refactor: move RBAC functions (require_permission) from erp-auth to erp-core
to avoid cross-module dependencies.

Add 20 new seed permissions for config module operations.

crates/erp-config/src/handler/theme_handler.rs

@@ -0,0 +1,69 @@
+use axum::Extension;
+use axum::extract::{FromRef, Json, State};
+use axum::response::Json as JsonResponse;
+
+use erp_core::error::AppError;
+use erp_core::rbac::require_permission;
+use erp_core::types::{ApiResponse, TenantContext};
+
+use crate::config_state::ConfigState;
+use crate::dto::ThemeResp;
+use crate::service::setting_service::SettingService;
+
+/// GET /api/v1/theme
+///
+/// 获取当前租户的主题配置。
+/// 主题配置存储在 settings 表中，key 为 "theme"，scope 为 "tenant"。
+/// 需要 `theme.read` 权限。
+pub async fn get_theme<S>(
+    State(state): State<ConfigState>,
+    Extension(ctx): Extension<TenantContext>,
+) -> Result<JsonResponse<ApiResponse<ThemeResp>>, AppError>
+where
+    ConfigState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "theme.read")?;
+
+    let setting =
+        SettingService::get("theme", "tenant", &None, ctx.tenant_id, &state.db).await?;
+
+    let theme: ThemeResp = serde_json::from_value(setting.setting_value)
+        .map_err(|e| AppError::Validation(format!("主题配置解析失败: {e}")))?;
+
+    Ok(JsonResponse(ApiResponse::ok(theme)))
+}
+
+/// PUT /api/v1/theme
+///
+/// 更新当前租户的主题配置。
+/// 将主题配置序列化为 JSON 存储到 settings 表。
+/// 需要 `theme.update` 权限。
+pub async fn update_theme<S>(
+    State(state): State<ConfigState>,
+    Extension(ctx): Extension<TenantContext>,
+    Json(req): Json<ThemeResp>,
+) -> Result<JsonResponse<ApiResponse<ThemeResp>>, AppError>
+where
+    ConfigState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "theme.update")?;
+
+    let value = serde_json::to_value(&req)
+        .map_err(|e| AppError::Validation(format!("主题配置序列化失败: {e}")))?;
+
+    SettingService::set(
+        "theme",
+        "tenant",
+        &None,
+        value,
+        ctx.tenant_id,
+        ctx.user_id,
+        &state.db,
+        &state.event_bus,
+    )
+    .await?;
+
+    Ok(JsonResponse(ApiResponse::ok(req)))
+}