feat(core): add audit logging to all mutation operations

Create audit_log SeaORM entity and audit_service::record() helper.
Integrate audit recording into 35 mutation endpoints across all modules:
- erp-auth: user/role/organization/department/position CRUD (15 actions)
- erp-config: dictionary/menu/setting/numbering_rule CRUD (15 actions)
- erp-workflow: definition/instance/task operations (8 actions)
- erp-message: send/system/mark_read/delete (5 actions)

Uses fire-and-forget pattern — audit failures logged but non-blocking.

crates/erp-config/src/service/setting_service.rs

@@ -7,6 +7,8 @@ use uuid::Uuid;
 use crate::dto::SettingResp;
 use crate::entity::setting;
 use crate::error::{ConfigError, ConfigResult};
+use erp_core::audit::AuditLog;
+use erp_core::audit_service;
 use erp_core::error::check_version;
 use erp_core::events::EventBus;
 use erp_core::types::Pagination;
@@ -117,6 +119,13 @@ impl SettingService {
                 }),
             ));
 
+            audit_service::record(
+                AuditLog::new(tenant_id, Some(operator_id), "setting.upsert", "setting")
+                    .with_resource_id(updated.id),
+                db,
+            )
+            .await;
+
             Ok(Self::model_to_resp(&updated))
         } else {
             // Insert new record
@@ -151,6 +160,13 @@ impl SettingService {
                 }),
             ));
 
+            audit_service::record(
+                AuditLog::new(tenant_id, Some(operator_id), "setting.upsert", "setting")
+                    .with_resource_id(id),
+                db,
+            )
+            .await;
+
             Ok(Self::model_to_resp(&inserted))
         }
     }
@@ -217,6 +233,7 @@ impl SettingService {
         let next_version =
             check_version(version, model.version).map_err(|_| ConfigError::VersionMismatch)?;
 
+        let setting_id = model.id;
         let mut active: setting::ActiveModel = model.into();
         active.deleted_at = Set(Some(Utc::now()));
         active.updated_at = Set(Utc::now());
@@ -227,6 +244,13 @@ impl SettingService {
             .await
             .map_err(|e| ConfigError::Validation(e.to_string()))?;
 
+        audit_service::record(
+            AuditLog::new(tenant_id, Some(operator_id), "setting.delete", "setting")
+                .with_resource_id(setting_id),
+            db,
+        )
+        .await;
+
         Ok(())
     }