feat: systematic functional audit — fix 18 issues across Phase A/B

Phase A (P1 production blockers):
- A1: Apply IP rate limiting to public routes (login/refresh)
- A2: Publish domain events for workflow instance state transitions
  (completed/suspended/resumed/terminated) via outbox pattern
- A3: Replace hardcoded nil UUID default tenant with dynamic DB lookup
- A4: Add GET /api/v1/audit-logs query endpoint with pagination
- A5: Enhance CORS wildcard warning for production environments

Phase B (P2 functional gaps):
- B1: Remove dead erp-common crate (zero references in codebase)
- B2: Refactor 5 settings pages to use typed API modules instead of
  direct client calls; create api/themes.ts; delete dead errors.ts
- B3: Add resume/suspend buttons to InstanceMonitor page
- B4: Remove unused EventHandler trait from erp-core
- B5: Handle task.completed events in message module (send notifications)
- B6: Wire TimeoutChecker as 60s background task
- B7: Auto-skip ServiceTask nodes instead of crashing the process
- B8: Remove empty register_routes() from ErpModule trait and modules

apps/web/src/pages/settings/SystemSettings.tsx

@@ -11,7 +11,11 @@ import {
   Modal,
 } from 'antd';
 import { PlusOutlined, SearchOutlined } from '@ant-design/icons';
-import client from '../../api/client';
+import {
+  getSetting,
+  updateSetting,
+  deleteSetting,
+} from '../../api/settings';
 
 // --- Types ---
 
@@ -35,20 +39,18 @@ export default function SystemSettings() {
       return;
     }
     try {
-      const { data: resp } = await client.get(
-        `/config/settings/${encodeURIComponent(searchKey.trim())}`,
-      );
-      const value = resp.data?.setting_value ?? resp.data?.value ?? resp.setting_value ?? resp.value ?? '';
+      const result = await getSetting(searchKey.trim());
+      const value = String(result.setting_value ?? '');
 
       // Check if already in local list
       setEntries((prev) => {
         const exists = prev.findIndex((e) => e.key === searchKey.trim());
         if (exists >= 0) {
           const updated = [...prev];
-          updated[exists] = { ...updated[exists], value: String(value) };
+          updated[exists] = { ...updated[exists], value };
           return updated;
         }
-        return [...prev, { key: searchKey.trim(), value: String(value) }];
+        return [...prev, { key: searchKey.trim(), value }];
       });
       message.success('查询成功');
     } catch (err: unknown) {
@@ -73,9 +75,7 @@ export default function SystemSettings() {
         return;
       }
 
-      await client.put(`/config/settings/${encodeURIComponent(key)}`, {
-        setting_value: value,
-      });
+      await updateSetting(key, value);
 
       setEntries((prev) => {
         const exists = prev.findIndex((e) => e.key === key);
@@ -99,7 +99,7 @@ export default function SystemSettings() {
 
   const handleDelete = async (key: string) => {
     try {
-      await client.delete(`/config/settings/${encodeURIComponent(key)}`);
+      await deleteSetting(key);
       setEntries((prev) => prev.filter((e) => e.key !== key));
       message.success('设置已删除');
     } catch {