feat(config): add system configuration module (Phase 3)

Implement the complete erp-config crate with:
- Data dictionaries (CRUD + items management)
- Dynamic menus (tree structure with role filtering)
- System settings (hierarchical: platform > tenant > org > user)
- Numbering rules (concurrency-safe via PostgreSQL advisory_lock)
- Theme and language configuration (via settings store)
- 6 database migrations (dictionaries, menus, settings, numbering_rules)
- Frontend Settings page with 5 tabs (dictionary, menu, numbering, settings, theme)

Refactor: move RBAC functions (require_permission) from erp-auth to erp-core
to avoid cross-module dependencies.

Add 20 new seed permissions for config module operations.

crates/erp-config/src/module.rs

@@ -0,0 +1,125 @@
+use axum::Router;
+use axum::routing::{get, post, put};
+use uuid::Uuid;
+
+use erp_core::error::AppResult;
+use erp_core::events::EventBus;
+use erp_core::module::ErpModule;
+
+use crate::handler::{
+    dictionary_handler, language_handler, menu_handler, numbering_handler, setting_handler,
+    theme_handler,
+};
+
+/// Config module implementing the `ErpModule` trait.
+///
+/// Manages system configuration: dictionaries, menus, settings,
+/// numbering rules, languages, and themes.
+pub struct ConfigModule;
+
+impl ConfigModule {
+    pub fn new() -> Self {
+        Self
+    }
+
+    /// Build protected (authenticated) routes for the config module.
+    pub fn protected_routes<S>() -> Router<S>
+    where
+        crate::config_state::ConfigState: axum::extract::FromRef<S>,
+        S: Clone + Send + Sync + 'static,
+    {
+        Router::new()
+            // Dictionary routes
+            .route(
+                "/config/dictionaries",
+                get(dictionary_handler::list_dictionaries)
+                    .post(dictionary_handler::create_dictionary),
+            )
+            .route(
+                "/config/dictionaries/{id}",
+                put(dictionary_handler::update_dictionary)
+                    .delete(dictionary_handler::delete_dictionary),
+            )
+            .route(
+                "/config/dictionaries/items",
+                get(dictionary_handler::list_items_by_code),
+            )
+            // Menu routes
+            .route(
+                "/config/menus",
+                get(menu_handler::get_menus).put(menu_handler::batch_save_menus),
+            )
+            // Setting routes
+            .route(
+                "/config/settings/{key}",
+                get(setting_handler::get_setting).put(setting_handler::update_setting),
+            )
+            // Numbering rule routes
+            .route(
+                "/config/numbering-rules",
+                get(numbering_handler::list_numbering_rules)
+                    .post(numbering_handler::create_numbering_rule),
+            )
+            .route(
+                "/config/numbering-rules/{id}",
+                put(numbering_handler::update_numbering_rule),
+            )
+            .route(
+                "/config/numbering-rules/{id}/generate",
+                post(numbering_handler::generate_number),
+            )
+            // Theme routes
+            .route(
+                "/config/themes",
+                get(theme_handler::get_theme).put(theme_handler::update_theme),
+            )
+            // Language routes
+            .route(
+                "/config/languages",
+                get(language_handler::list_languages),
+            )
+            .route(
+                "/config/languages/{code}",
+                put(language_handler::update_language),
+            )
+    }
+}
+
+impl Default for ConfigModule {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait::async_trait]
+impl ErpModule for ConfigModule {
+    fn name(&self) -> &str {
+        "config"
+    }
+
+    fn version(&self) -> &str {
+        env!("CARGO_PKG_VERSION")
+    }
+
+    fn dependencies(&self) -> Vec<&str> {
+        vec!["auth"]
+    }
+
+    fn register_routes(&self, router: Router) -> Router {
+        router
+    }
+
+    fn register_event_handlers(&self, _bus: &EventBus) {}
+
+    async fn on_tenant_created(&self, _tenant_id: Uuid) -> AppResult<()> {
+        Ok(())
+    }
+
+    async fn on_tenant_deleted(&self, _tenant_id: Uuid) -> AppResult<()> {
+        Ok(())
+    }
+
+    fn as_any(&self) -> &dyn std::any::Any {
+        self
+    }
+}