fix: address Phase 1-2 audit findings

- CORS: replace permissive() with configurable whitelist (default.toml)
- Auth store: synchronously restore state at creation to eliminate
  flash-of-login-page on refresh
- MainLayout: menu highlight now tracks current route via useLocation
- Add extractErrorMessage() utility to reduce repeated error parsing
- Fix all clippy warnings across 4 crates (erp-auth, erp-config,
  erp-workflow, erp-message): remove unnecessary casts, use div_ceil,
  collapse nested ifs, reduce function arguments with DTOs

crates/erp-auth/src/service/org_service.rs

@@ -137,18 +137,18 @@ impl OrgService {
             .ok_or_else(|| AuthError::Validation("组织不存在".to_string()))?;
 
         // If code is being changed, check uniqueness
-        if let Some(ref new_code) = req.code {
-            if Some(new_code) != model.code.as_ref() {
-                let existing = organization::Entity::find()
-                    .filter(organization::Column::TenantId.eq(tenant_id))
-                    .filter(organization::Column::Code.eq(new_code.as_str()))
-                    .filter(organization::Column::DeletedAt.is_null())
-                    .one(db)
-                    .await
-                    .map_err(|e| AuthError::Validation(e.to_string()))?;
-                if existing.is_some() {
-                    return Err(AuthError::Validation("组织编码已存在".to_string()));
-                }
+        if let Some(ref new_code) = req.code
+            && Some(new_code) != model.code.as_ref()
+        {
+            let existing = organization::Entity::find()
+                .filter(organization::Column::TenantId.eq(tenant_id))
+                .filter(organization::Column::Code.eq(new_code.as_str()))
+                .filter(organization::Column::DeletedAt.is_null())
+                .one(db)
+                .await
+                .map_err(|e| AuthError::Validation(e.to_string()))?;
+            if existing.is_some() {
+                return Err(AuthError::Validation("组织编码已存在".to_string()));
             }
         }