feat(core): implement optimistic locking across all entities

Add VersionMismatch error variant and check_version() helper to erp-core.
All 13 mutable entities now enforce version checking on update/delete:
- erp-auth: user, role, organization, department, position
- erp-config: dictionary, dictionary_item, menu, setting, numbering_rule
- erp-workflow: process_definition, process_instance, task
- erp-message: message, message_subscription

Update DTOs to expose version in responses and require version in update
requests. HTTP 409 Conflict returned on version mismatch.

crates/erp-workflow/src/dto.rs

@@ -79,6 +79,7 @@ pub struct ProcessDefinitionResp {
     pub status: String,
     pub created_at: DateTime<Utc>,
     pub updated_at: DateTime<Utc>,
+    pub lock_version: i32,
 }
 
 #[derive(Debug, Deserialize, Validate, ToSchema)]
@@ -101,6 +102,7 @@ pub struct UpdateProcessDefinitionReq {
     pub description: Option<String>,
     pub nodes: Option<Vec<NodeDef>>,
     pub edges: Option<Vec<EdgeDef>>,
+    pub version: i32,
 }
 
 // --- 流程实例 DTOs ---
@@ -120,6 +122,7 @@ pub struct ProcessInstanceResp {
     pub created_at: DateTime<Utc>,
     /// 当前活跃的 token 位置
     pub active_tokens: Vec<TokenResp>,
+    pub version: i32,
 }
 
 #[derive(Debug, Deserialize, Validate, ToSchema)]
@@ -169,6 +172,7 @@ pub struct TaskResp {
     pub definition_name: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub business_key: Option<String>,
+    pub version: i32,
 }
 
 #[derive(Debug, Deserialize, Validate, ToSchema)]