feat(auth): add handlers, JWT middleware, RBAC, and module registration

- Auth handlers: login/refresh/logout + user CRUD with tenant isolation
- JWT middleware: Bearer token validation → TenantContext injection
- RBAC helpers: require_permission, require_any_permission, require_role
- AuthModule: implements ErpModule with public/protected route split
- AuthState: FromRef pattern avoids circular deps between erp-auth and erp-server
- Server: public routes (health+login+refresh) + protected routes (JWT middleware)
- ErpModule trait: added as_any() for downcast support
- Workspace: added async-trait, sha2 dependencies

crates/erp-auth/src/lib.rs

@@ -1,4 +1,11 @@
+pub mod auth_state;
 pub mod dto;
 pub mod entity;
 pub mod error;
+pub mod handler;
+pub mod middleware;
+pub mod module;
 pub mod service;
+
+pub use auth_state::AuthState;
+pub use module::AuthModule;