feat(workflow): add workflow engine module (Phase 4)

Implement complete workflow engine with BPMN subset support:

Backend (erp-workflow crate):
- Token-driven execution engine with exclusive/parallel gateway support
- BPMN parser with flow graph validation
- Expression evaluator for conditional branching
- Process definition CRUD with draft/publish lifecycle
- Process instance management (start, suspend, terminate)
- Task service (pending, complete, delegate)
- PostgreSQL advisory locks for concurrent safety
- 5 database tables: process_definitions, process_instances,
  tokens, tasks, process_variables
- 13 API endpoints with RBAC protection
- Timeout checker framework (placeholder)

Frontend:
- Workflow page with 4 tabs (definitions, pending, completed, monitor)
- React Flow visual process designer (@xyflow/react)
- Process viewer with active node highlighting
- 3 API client modules for workflow endpoints
- Sidebar menu integration

crates/erp-server/migration/src/m20260412_000021_create_tasks.rs

@@ -0,0 +1,160 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(Tasks::Table)
+                    .if_not_exists()
+                    .col(
+                        ColumnDef::new(Tasks::Id)
+                            .uuid()
+                            .not_null()
+                            .primary_key(),
+                    )
+                    .col(ColumnDef::new(Tasks::TenantId).uuid().not_null())
+                    .col(ColumnDef::new(Tasks::InstanceId).uuid().not_null())
+                    .col(ColumnDef::new(Tasks::TokenId).uuid().not_null())
+                    .col(ColumnDef::new(Tasks::NodeId).string().not_null())
+                    .col(ColumnDef::new(Tasks::NodeName).string().null())
+                    .col(ColumnDef::new(Tasks::AssigneeId).uuid().null())
+                    .col(ColumnDef::new(Tasks::CandidateGroups).json_binary().null())
+                    .col(
+                        ColumnDef::new(Tasks::Status)
+                            .string()
+                            .not_null()
+                            .default("pending"),
+                    )
+                    .col(ColumnDef::new(Tasks::Outcome).string().null())
+                    .col(ColumnDef::new(Tasks::FormData).json_binary().null())
+                    .col(
+                        ColumnDef::new(Tasks::DueDate)
+                            .timestamp_with_time_zone()
+                            .null(),
+                    )
+                    .col(
+                        ColumnDef::new(Tasks::CompletedAt)
+                            .timestamp_with_time_zone()
+                            .null(),
+                    )
+                    .col(
+                        ColumnDef::new(Tasks::CreatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        ColumnDef::new(Tasks::UpdatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(ColumnDef::new(Tasks::CreatedBy).uuid().not_null())
+                    .col(ColumnDef::new(Tasks::UpdatedBy).uuid().not_null())
+                    .col(
+                        ColumnDef::new(Tasks::DeletedAt)
+                            .timestamp_with_time_zone()
+                            .null(),
+                    )
+                    .col(
+                        ColumnDef::new(Tasks::Version)
+                            .integer()
+                            .not_null()
+                            .default(1),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx_tasks_assignee")
+                    .table(Tasks::Table)
+                    .col(Tasks::TenantId)
+                    .col(Tasks::AssigneeId)
+                    .col(Tasks::Status)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx_tasks_instance")
+                    .table(Tasks::Table)
+                    .col(Tasks::InstanceId)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_foreign_key(
+                ForeignKey::create()
+                    .name("fk_tasks_instance")
+                    .from(Tasks::Table, Tasks::InstanceId)
+                    .to(ProcessInstances::Table, ProcessInstances::Id)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_foreign_key(
+                ForeignKey::create()
+                    .name("fk_tasks_token")
+                    .from(Tasks::Table, Tasks::TokenId)
+                    .to(WfTokens::Table, WfTokens::Id)
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(Tasks::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum Tasks {
+    Table,
+    Id,
+    TenantId,
+    InstanceId,
+    TokenId,
+    NodeId,
+    NodeName,
+    AssigneeId,
+    CandidateGroups,
+    Status,
+    Outcome,
+    FormData,
+    DueDate,
+    CompletedAt,
+    CreatedAt,
+    UpdatedAt,
+    CreatedBy,
+    UpdatedBy,
+    DeletedAt,
+    Version,
+}
+
+#[derive(DeriveIden)]
+enum ProcessInstances {
+    Table,
+    Id,
+}
+
+#[derive(DeriveIden)]
+enum WfTokens {
+    Table,
+    Id,
+}