feat(workflow): add workflow engine module (Phase 4)

Implement complete workflow engine with BPMN subset support:

Backend (erp-workflow crate):
- Token-driven execution engine with exclusive/parallel gateway support
- BPMN parser with flow graph validation
- Expression evaluator for conditional branching
- Process definition CRUD with draft/publish lifecycle
- Process instance management (start, suspend, terminate)
- Task service (pending, complete, delegate)
- PostgreSQL advisory locks for concurrent safety
- 5 database tables: process_definitions, process_instances,
  tokens, tasks, process_variables
- 13 API endpoints with RBAC protection
- Timeout checker framework (placeholder)

Frontend:
- Workflow page with 4 tabs (definitions, pending, completed, monitor)
- React Flow visual process designer (@xyflow/react)
- Process viewer with active node highlighting
- 3 API client modules for workflow endpoints
- Sidebar menu integration

crates/erp-server/src/main.rs

@@ -105,10 +105,15 @@ async fn main() -> anyhow::Result<()> {
     let config_module = erp_config::ConfigModule::new();
     tracing::info!(module = config_module.name(), version = config_module.version(), "Config module initialized");
 
+    // Initialize workflow module
+    let workflow_module = erp_workflow::WorkflowModule::new();
+    tracing::info!(module = workflow_module.name(), version = workflow_module.version(), "Workflow module initialized");
+
     // Initialize module registry and register modules
     let registry = ModuleRegistry::new()
         .register(auth_module)
-        .register(config_module);
+        .register(config_module)
+        .register(workflow_module);
     tracing::info!(module_count = registry.modules().len(), "Modules registered");
 
     // Register event handlers
@@ -146,6 +151,7 @@ async fn main() -> anyhow::Result<()> {
     // Protected routes (JWT authentication required)
     let protected_routes = erp_auth::AuthModule::protected_routes()
         .merge(erp_config::ConfigModule::protected_routes())
+        .merge(erp_workflow::WorkflowModule::protected_routes())
         .layer(middleware::from_fn(move |req, next| {
             let secret = jwt_secret.clone();
             async move { jwt_auth_middleware_fn(secret, req, next).await }

crates/erp-server/src/state.rs

@@ -60,3 +60,13 @@ impl FromRef<AppState> for erp_config::ConfigState {
         }
     }
 }
+
+/// Allow erp-workflow handlers to extract their required state without depending on erp-server.
+impl FromRef<AppState> for erp_workflow::WorkflowState {
+    fn from_ref(state: &AppState) -> Self {
+        Self {
+            db: state.db.clone(),
+            event_bus: state.event_bus.clone(),
+        }
+    }
+}