feat(config): add system configuration module (Phase 3)

Implement the complete erp-config crate with:
- Data dictionaries (CRUD + items management)
- Dynamic menus (tree structure with role filtering)
- System settings (hierarchical: platform > tenant > org > user)
- Numbering rules (concurrency-safe via PostgreSQL advisory_lock)
- Theme and language configuration (via settings store)
- 6 database migrations (dictionaries, menus, settings, numbering_rules)
- Frontend Settings page with 5 tabs (dictionary, menu, numbering, settings, theme)

Refactor: move RBAC functions (require_permission) from erp-auth to erp-core
to avoid cross-module dependencies.

Add 20 new seed permissions for config module operations.

crates/erp-server/migration/src/m20260412_000016_create_settings.rs

@@ -0,0 +1,99 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(Settings::Table)
+                    .if_not_exists()
+                    .col(
+                        ColumnDef::new(Settings::Id)
+                            .uuid()
+                            .not_null()
+                            .primary_key(),
+                    )
+                    .col(ColumnDef::new(Settings::TenantId).uuid().not_null())
+                    .col(ColumnDef::new(Settings::Scope).string().not_null())
+                    .col(ColumnDef::new(Settings::ScopeId).uuid().null())
+                    .col(ColumnDef::new(Settings::SettingKey).string().not_null())
+                    .col(
+                        ColumnDef::new(Settings::SettingValue)
+                            .json_binary()
+                            .not_null()
+                            .default(Expr::val("{}")),
+                    )
+                    .col(
+                        ColumnDef::new(Settings::CreatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        ColumnDef::new(Settings::UpdatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(ColumnDef::new(Settings::CreatedBy).uuid().not_null())
+                    .col(ColumnDef::new(Settings::UpdatedBy).uuid().not_null())
+                    .col(
+                        ColumnDef::new(Settings::DeletedAt)
+                            .timestamp_with_time_zone()
+                            .null(),
+                    )
+                    .col(
+                        ColumnDef::new(Settings::Version)
+                            .integer()
+                            .not_null()
+                            .default(1),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx_settings_tenant_id")
+                    .table(Settings::Table)
+                    .col(Settings::TenantId)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager.get_connection().execute(sea_orm::Statement::from_string(
+            sea_orm::DatabaseBackend::Postgres,
+            "CREATE UNIQUE INDEX idx_settings_scope_key ON settings (scope, scope_id, setting_key) WHERE deleted_at IS NULL".to_string(),
+        )).await.map_err(|e| DbErr::Custom(e.to_string()))?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(Settings::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum Settings {
+    Table,
+    Id,
+    TenantId,
+    Scope,
+    ScopeId,
+    SettingKey,
+    SettingValue,
+    CreatedAt,
+    UpdatedAt,
+    CreatedBy,
+    UpdatedBy,
+    DeletedAt,
+    Version,
+}