feat: systematic functional audit — fix 18 issues across Phase A/B

Phase A (P1 production blockers):
- A1: Apply IP rate limiting to public routes (login/refresh)
- A2: Publish domain events for workflow instance state transitions
  (completed/suspended/resumed/terminated) via outbox pattern
- A3: Replace hardcoded nil UUID default tenant with dynamic DB lookup
- A4: Add GET /api/v1/audit-logs query endpoint with pagination
- A5: Enhance CORS wildcard warning for production environments

Phase B (P2 functional gaps):
- B1: Remove dead erp-common crate (zero references in codebase)
- B2: Refactor 5 settings pages to use typed API modules instead of
  direct client calls; create api/themes.ts; delete dead errors.ts
- B3: Add resume/suspend buttons to InstanceMonitor page
- B4: Remove unused EventHandler trait from erp-core
- B5: Handle task.completed events in message module (send notifications)
- B6: Wire TimeoutChecker as 60s background task
- B7: Auto-skip ServiceTask nodes instead of crashing the process
- B8: Remove empty register_routes() from ErpModule trait and modules

crates/erp-server/src/state.rs

@@ -14,6 +14,8 @@ pub struct AppState {
     pub event_bus: EventBus,
     pub module_registry: ModuleRegistry,
     pub redis: redis::Client,
+    /// 实际的默认租户 ID，从数据库种子数据中获取。
+    pub default_tenant_id: uuid::Uuid,
 }
 
 /// Allow handlers to extract `DatabaseConnection` directly from `State<AppState>`.
@@ -44,10 +46,7 @@ impl FromRef<AppState> for erp_auth::AuthState {
             jwt_secret: state.config.jwt.secret.clone(),
             access_ttl_secs: parse_ttl(&state.config.jwt.access_token_ttl),
             refresh_ttl_secs: parse_ttl(&state.config.jwt.refresh_token_ttl),
-            // Default tenant ID: during bootstrap, use a well-known UUID.
-            // In production, tenant resolution middleware will override this.
-            default_tenant_id: uuid::Uuid::parse_str("00000000-0000-0000-0000-000000000000")
-                .unwrap(),
+            default_tenant_id: state.default_tenant_id,
         }
     }
 }