fix: address Phase 1-2 audit findings

- CORS: replace permissive() with configurable whitelist (default.toml)
- Auth store: synchronously restore state at creation to eliminate
  flash-of-login-page on refresh
- MainLayout: menu highlight now tracks current route via useLocation
- Add extractErrorMessage() utility to reduce repeated error parsing
- Fix all clippy warnings across 4 crates (erp-auth, erp-config,
  erp-workflow, erp-message): remove unnecessary casts, use div_ceil,
  collapse nested ifs, reduce function arguments with DTOs

crates/erp-workflow/src/service/definition_service.rs

@@ -33,7 +33,7 @@ impl DefinitionService {
             .await
             .map_err(|e| WorkflowError::Validation(e.to_string()))?;
 
-        let page_index = pagination.page.unwrap_or(1).saturating_sub(1) as u64;
+        let page_index = pagination.page.unwrap_or(1).saturating_sub(1);
         let models = paginator
             .fetch_page(page_index)
             .await