fix: address Phase 1-2 audit findings

- CORS: replace permissive() with configurable whitelist (default.toml)
- Auth store: synchronously restore state at creation to eliminate
  flash-of-login-page on refresh
- MainLayout: menu highlight now tracks current route via useLocation
- Add extractErrorMessage() utility to reduce repeated error parsing
- Fix all clippy warnings across 4 crates (erp-auth, erp-config,
  erp-workflow, erp-message): remove unnecessary casts, use div_ceil,
  collapse nested ifs, reduce function arguments with DTOs

crates/erp-workflow/src/service/definition_service.rs

@@ -33,7 +33,7 @@ impl DefinitionService {
             .await
             .map_err(|e| WorkflowError::Validation(e.to_string()))?;
 
-        let page_index = pagination.page.unwrap_or(1).saturating_sub(1) as u64;
+        let page_index = pagination.page.unwrap_or(1).saturating_sub(1);
         let models = paginator
             .fetch_page(page_index)
             .await

crates/erp-workflow/src/service/task_service.rs

@@ -38,7 +38,7 @@ impl TaskService {
             .await
             .map_err(|e| WorkflowError::Validation(e.to_string()))?;
 
-        let page_index = pagination.page.unwrap_or(1).saturating_sub(1) as u64;
+        let page_index = pagination.page.unwrap_or(1).saturating_sub(1);
         let models = paginator
             .fetch_page(page_index)
             .await
@@ -80,7 +80,7 @@ impl TaskService {
         let paginator = task::Entity::find()
             .filter(task::Column::TenantId.eq(tenant_id))
             .filter(task::Column::AssigneeId.eq(assignee_id))
-            .filter(task::Column::Status.is_in(["approved", "rejected", "delegated"]))
+            .filter(task::Column::Status.is_in(["completed", "approved", "rejected", "delegated"]))
             .filter(task::Column::DeletedAt.is_null())
             .paginate(db, pagination.limit());
 
@@ -89,7 +89,7 @@ impl TaskService {
             .await
             .map_err(|e| WorkflowError::Validation(e.to_string()))?;
 
-        let page_index = pagination.page.unwrap_or(1).saturating_sub(1) as u64;
+        let page_index = pagination.page.unwrap_or(1).saturating_sub(1);
         let models = paginator
             .fetch_page(page_index)
             .await
@@ -142,6 +142,13 @@ impl TaskService {
             ));
         }
 
+        // 验证操作者是当前处理人
+        if task_model.assignee_id != Some(operator_id) {
+            return Err(WorkflowError::InvalidState(
+                "只有当前处理人才能完成任务".to_string(),
+            ));
+        }
+
         let instance_id = task_model.instance_id;
         let token_id = task_model.token_id;
 
@@ -162,6 +169,13 @@ impl TaskService {
                 WorkflowError::NotFound(format!("流程定义不存在: {}", instance.definition_id))
             })?;
 
+        if instance.status != "running" {
+            return Err(WorkflowError::InvalidState(format!(
+                "流程实例状态不是 running: {}",
+                instance.status
+            )));
+        }
+
         let nodes: Vec<crate::dto::NodeDef> =
             serde_json::from_value(definition.nodes.clone()).map_err(|e| {
                 WorkflowError::InvalidDiagram(format!("节点数据无效: {e}"))
@@ -174,11 +188,11 @@ impl TaskService {
 
         // 准备变量（从 req.form_data 中提取）
         let mut variables = HashMap::new();
-        if let Some(form) = &req.form_data {
-            if let Some(obj) = form.as_object() {
-                for (k, v) in obj {
-                    variables.insert(k.clone(), v.clone());
-                }
+        if let Some(form) = &req.form_data
+            && let Some(obj) = form.as_object()
+        {
+            for (k, v) in obj {
+                variables.insert(k.clone(), v.clone());
             }
         }
 
@@ -257,6 +271,13 @@ impl TaskService {
             ));
         }
 
+        // 验证操作者是当前处理人
+        if task_model.assignee_id != Some(operator_id) {
+            return Err(WorkflowError::InvalidState(
+                "只有当前处理人才能委派任务".to_string(),
+            ));
+        }
+
         let mut active: task::ActiveModel = task_model.into();
         active.assignee_id = Set(Some(req.delegate_to));
         active.updated_at = Set(Utc::now());
@@ -271,6 +292,7 @@ impl TaskService {
     }
 
     /// 创建任务记录（由执行引擎调用）。
+    #[allow(clippy::too_many_arguments)]
     pub async fn create_task(
         instance_id: Uuid,
         tenant_id: Uuid,