fix: address Phase 1-2 audit findings

- CORS: replace permissive() with configurable whitelist (default.toml)
- Auth store: synchronously restore state at creation to eliminate
  flash-of-login-page on refresh
- MainLayout: menu highlight now tracks current route via useLocation
- Add extractErrorMessage() utility to reduce repeated error parsing
- Fix all clippy warnings across 4 crates (erp-auth, erp-config,
  erp-workflow, erp-message): remove unnecessary casts, use div_ceil,
  collapse nested ifs, reduce function arguments with DTOs

crates/erp-server/config/default.toml

@@ -20,3 +20,7 @@ super_admin_password = "Admin@2026"
 
 [log]
 level = "info"
+
+[cors]
+# Comma-separated allowed origins. Use "*" for development only.
+allowed_origins = "http://localhost:5173,http://localhost:3000"