feat(workflow): add workflow engine module (Phase 4)

Implement complete workflow engine with BPMN subset support:

Backend (erp-workflow crate):
- Token-driven execution engine with exclusive/parallel gateway support
- BPMN parser with flow graph validation
- Expression evaluator for conditional branching
- Process definition CRUD with draft/publish lifecycle
- Process instance management (start, suspend, terminate)
- Task service (pending, complete, delegate)
- PostgreSQL advisory locks for concurrent safety
- 5 database tables: process_definitions, process_instances,
  tokens, tasks, process_variables
- 13 API endpoints with RBAC protection
- Timeout checker framework (placeholder)

Frontend:
- Workflow page with 4 tabs (definitions, pending, completed, monitor)
- React Flow visual process designer (@xyflow/react)
- Process viewer with active node highlighting
- 3 API client modules for workflow endpoints
- Sidebar menu integration

crates/erp-server/migration/src/m20260412_000020_create_tokens.rs

@@ -0,0 +1,90 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(Tokens::Table)
+                    .if_not_exists()
+                    .col(
+                        ColumnDef::new(Tokens::Id)
+                            .uuid()
+                            .not_null()
+                            .primary_key(),
+                    )
+                    .col(ColumnDef::new(Tokens::TenantId).uuid().not_null())
+                    .col(ColumnDef::new(Tokens::InstanceId).uuid().not_null())
+                    .col(ColumnDef::new(Tokens::NodeId).string().not_null())
+                    .col(
+                        ColumnDef::new(Tokens::Status)
+                            .string()
+                            .not_null()
+                            .default("active"),
+                    )
+                    .col(
+                        ColumnDef::new(Tokens::CreatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        ColumnDef::new(Tokens::ConsumedAt)
+                            .timestamp_with_time_zone()
+                            .null(),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx_tokens_instance")
+                    .table(Tokens::Table)
+                    .col(Tokens::InstanceId)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_foreign_key(
+                ForeignKey::create()
+                    .name("fk_tokens_instance")
+                    .from(Tokens::Table, Tokens::InstanceId)
+                    .to(ProcessInstances::Table, ProcessInstances::Id)
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(Tokens::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum Tokens {
+    Table,
+    Id,
+    TenantId,
+    InstanceId,
+    NodeId,
+    Status,
+    CreatedAt,
+    ConsumedAt,
+}
+
+#[derive(DeriveIden)]
+enum ProcessInstances {
+    Table,
+    Id,
+}