fix: address Phase 1-2 audit findings

- CORS: replace permissive() with configurable whitelist (default.toml)
- Auth store: synchronously restore state at creation to eliminate
  flash-of-login-page on refresh
- MainLayout: menu highlight now tracks current route via useLocation
- Add extractErrorMessage() utility to reduce repeated error parsing
- Fix all clippy warnings across 4 crates (erp-auth, erp-config,
  erp-workflow, erp-message): remove unnecessary casts, use div_ceil,
  collapse nested ifs, reduce function arguments with DTOs

crates/erp-config/src/dto.rs

@@ -143,6 +143,14 @@ pub struct UpdateSettingReq {
     pub setting_value: serde_json::Value,
 }
 
+/// 内部参数结构体，用于减少 SettingService::set 的参数数量。
+pub struct SetSettingParams {
+    pub key: String,
+    pub scope: String,
+    pub scope_id: Option<Uuid>,
+    pub value: serde_json::Value,
+}
+
 // --- Numbering Rule DTOs ---
 
 #[derive(Debug, Serialize, ToSchema)]