fix: address Phase 1-2 audit findings

- CORS: replace permissive() with configurable whitelist (default.toml)
- Auth store: synchronously restore state at creation to eliminate
  flash-of-login-page on refresh
- MainLayout: menu highlight now tracks current route via useLocation
- Add extractErrorMessage() utility to reduce repeated error parsing
- Fix all clippy warnings across 4 crates (erp-auth, erp-config,
  erp-workflow, erp-message): remove unnecessary casts, use div_ceil,
  collapse nested ifs, reduce function arguments with DTOs

apps/web/src/api/errors.ts

@@ -0,0 +1,13 @@
+/**
+ * Extract a user-friendly error message from an Axios error response.
+ *
+ * The backend returns `{ success: false, message: "..." }` on errors.
+ * This helper centralizes the extraction logic to avoid repeating the
+ * same type assertion in every catch block.
+ */
+export function extractErrorMessage(err: unknown, fallback = '操作失败'): string {
+  return (
+    (err as { response?: { data?: { message?: string } } })?.response?.data
+      ?.message || fallback
+  );
+}