feat(core): add audit logging to all mutation operations

Create audit_log SeaORM entity and audit_service::record() helper.
Integrate audit recording into 35 mutation endpoints across all modules:
- erp-auth: user/role/organization/department/position CRUD (15 actions)
- erp-config: dictionary/menu/setting/numbering_rule CRUD (15 actions)
- erp-workflow: definition/instance/task operations (8 actions)
- erp-message: send/system/mark_read/delete (5 actions)

Uses fire-and-forget pattern — audit failures logged but non-blocking.

crates/erp-auth/src/service/user_service.rs

@@ -5,6 +5,8 @@ use uuid::Uuid;
 use crate::dto::{CreateUserReq, RoleResp, UpdateUserReq, UserResp};
 use crate::entity::{role, user, user_credential, user_role};
 use crate::error::AuthError;
+use erp_core::audit::AuditLog;
+use erp_core::audit_service;
 use erp_core::error::check_version;
 use erp_core::events::EventBus;
 use erp_core::types::Pagination;
@@ -94,6 +96,13 @@ impl UserService {
             serde_json::json!({ "user_id": user_id, "username": req.username }),
         ));
 
+        audit_service::record(
+            AuditLog::new(tenant_id, Some(operator_id), "user.create", "user")
+                .with_resource_id(user_id),
+            db,
+        )
+        .await;
+
         Ok(UserResp {
             id: user_id,
             username: req.username.clone(),
@@ -215,6 +224,13 @@ impl UserService {
             .await
             .map_err(|e| AuthError::Validation(e.to_string()))?;
 
+        audit_service::record(
+            AuditLog::new(tenant_id, Some(operator_id), "user.update", "user")
+                .with_resource_id(id),
+            db,
+        )
+        .await;
+
         let roles = Self::fetch_user_role_resps(id, tenant_id, db).await?;
         Ok(model_to_resp(&updated, roles))
     }
@@ -250,6 +266,14 @@ impl UserService {
             tenant_id,
             serde_json::json!({ "user_id": id }),
         ));
+
+        audit_service::record(
+            AuditLog::new(tenant_id, Some(operator_id), "user.delete", "user")
+                .with_resource_id(id),
+            db,
+        )
+        .await;
+
         Ok(())
     }