feat(workflow): add workflow engine module (Phase 4)

Implement complete workflow engine with BPMN subset support:

Backend (erp-workflow crate):
- Token-driven execution engine with exclusive/parallel gateway support
- BPMN parser with flow graph validation
- Expression evaluator for conditional branching
- Process definition CRUD with draft/publish lifecycle
- Process instance management (start, suspend, terminate)
- Task service (pending, complete, delegate)
- PostgreSQL advisory locks for concurrent safety
- 5 database tables: process_definitions, process_instances,
  tokens, tasks, process_variables
- 13 API endpoints with RBAC protection
- Timeout checker framework (placeholder)

Frontend:
- Workflow page with 4 tabs (definitions, pending, completed, monitor)
- React Flow visual process designer (@xyflow/react)
- Process viewer with active node highlighting
- 3 API client modules for workflow endpoints
- Sidebar menu integration

crates/erp-auth/src/service/seed.rs

@@ -101,10 +101,19 @@ const DEFAULT_PERMISSIONS: &[(&str, &str, &str, &str, &str)] = &[
     ("theme:update", "编辑主题", "theme", "update", "编辑主题设置"),
     ("language:list", "查看语言", "language", "list", "查看语言配置"),
     ("language:update", "编辑语言", "language", "update", "编辑语言配置"),
+    // Workflow module permissions
+    ("workflow:create", "创建流程", "workflow", "create", "创建流程定义"),
+    ("workflow:list", "查看流程", "workflow", "list", "查看流程列表"),
+    ("workflow:read", "查看流程详情", "workflow", "read", "查看流程定义详情"),
+    ("workflow:update", "编辑流程", "workflow", "update", "编辑流程定义"),
+    ("workflow:publish", "发布流程", "workflow", "publish", "发布流程定义"),
+    ("workflow:start", "发起流程", "workflow", "start", "发起流程实例"),
+    ("workflow:approve", "审批任务", "workflow", "approve", "审批流程任务"),
+    ("workflow:delegate", "委派任务", "workflow", "delegate", "委派流程任务"),
 ];
 
 /// Indices of read-only permissions within DEFAULT_PERMISSIONS.
-const READ_PERM_INDICES: &[usize] = &[1, 5, 9, 11, 15, 19, 23, 24, 28, 29, 34, 38];
+const READ_PERM_INDICES: &[usize] = &[1, 5, 9, 11, 15, 19, 23, 24, 28, 29, 34, 38, 37, 38];
 
 /// Seed default auth data for a new tenant.
 ///