feat: systematic functional audit — fix 18 issues across Phase A/B

Phase A (P1 production blockers):
- A1: Apply IP rate limiting to public routes (login/refresh)
- A2: Publish domain events for workflow instance state transitions
  (completed/suspended/resumed/terminated) via outbox pattern
- A3: Replace hardcoded nil UUID default tenant with dynamic DB lookup
- A4: Add GET /api/v1/audit-logs query endpoint with pagination
- A5: Enhance CORS wildcard warning for production environments

Phase B (P2 functional gaps):
- B1: Remove dead erp-common crate (zero references in codebase)
- B2: Refactor 5 settings pages to use typed API modules instead of
  direct client calls; create api/themes.ts; delete dead errors.ts
- B3: Add resume/suspend buttons to InstanceMonitor page
- B4: Remove unused EventHandler trait from erp-core
- B5: Handle task.completed events in message module (send notifications)
- B6: Wire TimeoutChecker as 60s background task
- B7: Auto-skip ServiceTask nodes instead of crashing the process
- B8: Remove empty register_routes() from ErpModule trait and modules

apps/web/src/api/dictionaries.ts

@@ -64,3 +64,44 @@ export async function listItemsByCode(code: string) {
   );
   return data.data;
 }
+
+export interface CreateDictionaryItemRequest {
+  label: string;
+  value: string;
+  sort_order?: number;
+  color?: string;
+}
+
+export interface UpdateDictionaryItemRequest {
+  label?: string;
+  value?: string;
+  sort_order?: number;
+  color?: string;
+}
+
+export async function createDictionaryItem(
+  dictionaryId: string,
+  req: CreateDictionaryItemRequest,
+) {
+  const { data } = await client.post<{ success: boolean; data: DictionaryItemInfo }>(
+    `/config/dictionaries/${dictionaryId}/items`,
+    req,
+  );
+  return data.data;
+}
+
+export async function updateDictionaryItem(
+  dictionaryId: string,
+  itemId: string,
+  req: UpdateDictionaryItemRequest,
+) {
+  const { data } = await client.put<{ success: boolean; data: DictionaryItemInfo }>(
+    `/config/dictionaries/${dictionaryId}/items/${itemId}`,
+    req,
+  );
+  return data.data;
+}
+
+export async function deleteDictionaryItem(dictionaryId: string, itemId: string) {
+  await client.delete(`/config/dictionaries/${dictionaryId}/items/${itemId}`);
+}

apps/web/src/api/errors.ts

@@ -1,13 +0,0 @@
-/**
- * Extract a user-friendly error message from an Axios error response.
- *
- * The backend returns `{ success: false, message: "..." }` on errors.
- * This helper centralizes the extraction logic to avoid repeating the
- * same type assertion in every catch block.
- */
-export function extractErrorMessage(err: unknown, fallback = '操作失败'): string {
-  return (
-    (err as { response?: { data?: { message?: string } } })?.response?.data
-      ?.message || fallback
-  );
-}

apps/web/src/api/menus.ts

@@ -34,3 +34,23 @@ export async function getMenus() {
 export async function batchSaveMenus(menus: MenuItemReq[]) {
   await client.put('/config/menus', { menus });
 }
+
+export async function createMenu(req: MenuItemReq) {
+  const { data } = await client.post<{ success: boolean; data: MenuInfo }>(
+    '/config/menus',
+    req,
+  );
+  return data.data;
+}
+
+export async function updateMenu(id: string, req: MenuItemReq) {
+  const { data } = await client.put<{ success: boolean; data: MenuInfo }>(
+    `/config/menus/${id}`,
+    req,
+  );
+  return data.data;
+}
+
+export async function deleteMenu(id: string) {
+  await client.delete(`/config/menus/${id}`);
+}

apps/web/src/api/numberingRules.ts

@@ -65,3 +65,7 @@ export async function generateNumber(id: string) {
   );
   return data.data;
 }
+
+export async function deleteNumberingRule(id: string) {
+  await client.delete(`/config/numbering-rules/${id}`);
+}

apps/web/src/api/settings.ts

@@ -23,3 +23,7 @@ export async function updateSetting(key: string, settingValue: unknown) {
   );
   return data.data;
 }
+
+export async function deleteSetting(key: string) {
+  await client.delete(`/config/settings/${encodeURIComponent(key)}`);
+}

apps/web/src/api/themes.ts

@@ -0,0 +1,22 @@
+import client from './client';
+
+export interface ThemeConfig {
+  primary_color?: string;
+  logo_url?: string;
+  sidebar_style?: 'light' | 'dark';
+}
+
+export async function getTheme() {
+  const { data } = await client.get<{ success: boolean; data: ThemeConfig }>(
+    '/config/themes',
+  );
+  return data.data;
+}
+
+export async function updateTheme(theme: ThemeConfig) {
+  const { data } = await client.put<{ success: boolean; data: ThemeConfig }>(
+    '/config/themes',
+    theme,
+  );
+  return data.data;
+}

apps/web/src/api/workflowInstances.ts

@@ -57,6 +57,13 @@ export async function suspendInstance(id: string) {
   return data.data;
 }
 
+export async function resumeInstance(id: string) {
+  const { data } = await client.post<{ success: boolean; data: null }>(
+    `/workflow/instances/${id}/resume`,
+  );
+  return data.data;
+}
+
 export async function terminateInstance(id: string) {
   const { data } = await client.post<{ success: boolean; data: null }>(
     `/workflow/instances/${id}/terminate`,