feat(workflow): add workflow engine module (Phase 4)

Implement complete workflow engine with BPMN subset support:

Backend (erp-workflow crate):
- Token-driven execution engine with exclusive/parallel gateway support
- BPMN parser with flow graph validation
- Expression evaluator for conditional branching
- Process definition CRUD with draft/publish lifecycle
- Process instance management (start, suspend, terminate)
- Task service (pending, complete, delegate)
- PostgreSQL advisory locks for concurrent safety
- 5 database tables: process_definitions, process_instances,
  tokens, tasks, process_variables
- 13 API endpoints with RBAC protection
- Timeout checker framework (placeholder)

Frontend:
- Workflow page with 4 tabs (definitions, pending, completed, monitor)
- React Flow visual process designer (@xyflow/react)
- Process viewer with active node highlighting
- 3 API client modules for workflow endpoints
- Sidebar menu integration

crates/erp-server/migration/src/m20260412_000022_create_process_variables.rs

@@ -0,0 +1,84 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(ProcessVariables::Table)
+                    .if_not_exists()
+                    .col(
+                        ColumnDef::new(ProcessVariables::Id)
+                            .uuid()
+                            .not_null()
+                            .primary_key(),
+                    )
+                    .col(ColumnDef::new(ProcessVariables::TenantId).uuid().not_null())
+                    .col(ColumnDef::new(ProcessVariables::InstanceId).uuid().not_null())
+                    .col(ColumnDef::new(ProcessVariables::Name).string().not_null())
+                    .col(
+                        ColumnDef::new(ProcessVariables::VarType)
+                            .string()
+                            .not_null()
+                            .default("string"),
+                    )
+                    .col(ColumnDef::new(ProcessVariables::ValueString).text().null())
+                    .col(ColumnDef::new(ProcessVariables::ValueNumber).double().null())
+                    .col(ColumnDef::new(ProcessVariables::ValueBoolean).boolean().null())
+                    .col(
+                        ColumnDef::new(ProcessVariables::ValueDate)
+                            .timestamp_with_time_zone()
+                            .null(),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager.get_connection().execute(sea_orm::Statement::from_string(
+            sea_orm::DatabaseBackend::Postgres,
+            "CREATE UNIQUE INDEX idx_process_variables_instance_name ON process_variables (instance_id, name)".to_string(),
+        )).await.map_err(|e| DbErr::Custom(e.to_string()))?;
+
+        manager
+            .create_foreign_key(
+                ForeignKey::create()
+                    .name("fk_variables_instance")
+                    .from(ProcessVariables::Table, ProcessVariables::InstanceId)
+                    .to(ProcessInstances::Table, ProcessInstances::Id)
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(ProcessVariables::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum ProcessVariables {
+    Table,
+    Id,
+    TenantId,
+    InstanceId,
+    Name,
+    VarType,
+    ValueString,
+    ValueNumber,
+    ValueBoolean,
+    ValueDate,
+}
+
+#[derive(DeriveIden)]
+enum ProcessInstances {
+    Table,
+    Id,
+}