feat: add utoipa path annotations to all API handlers and wire OpenAPI spec

- Add #[utoipa::path] annotations to all 70+ handler functions across
  auth, config, workflow, and message modules
- Add IntoParams/ToSchema derives to Pagination, PaginatedResponse, ApiResponse
  in erp-core, and MessageQuery/TemplateQuery in erp-message
- Collect all module paths into OpenAPI spec via AuthApiDoc, ConfigApiDoc,
  WorkflowApiDoc, MessageApiDoc structs in erp-server main.rs
- Update openapi_spec handler to merge all module specs
- The /docs/openapi.json endpoint now returns complete API documentation
  with all endpoints, request/response schemas, and security requirements

crates/erp-config/src/handler/numbering_handler.rs

@@ -14,6 +14,18 @@ use crate::dto::{
 };
 use crate::service::numbering_service::NumberingService;
 
+#[utoipa::path(
+    get,
+    path = "/api/v1/numbering-rules",
+    params(Pagination),
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<PaginatedResponse<NumberingRuleResp>>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "编号规则"
+)]
 /// GET /api/v1/numbering-rules
 ///
 /// 分页查询当前租户下的编号规则列表。
@@ -44,6 +56,18 @@ where
     })))
 }
 
+#[utoipa::path(
+    post,
+    path = "/api/v1/numbering-rules",
+    request_body = CreateNumberingRuleReq,
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<NumberingRuleResp>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "编号规则"
+)]
 /// POST /api/v1/numbering-rules
 ///
 /// 创建新的编号规则。
@@ -75,6 +99,19 @@ where
     Ok(Json(ApiResponse::ok(rule)))
 }
 
+#[utoipa::path(
+    put,
+    path = "/api/v1/numbering-rules/{id}",
+    params(("id" = Uuid, Path, description = "编号规则ID")),
+    request_body = UpdateNumberingRuleReq,
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<NumberingRuleResp>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "编号规则"
+)]
 /// PUT /api/v1/numbering-rules/:id
 ///
 /// 更新编号规则的可编辑字段。
@@ -96,6 +133,18 @@ where
     Ok(Json(ApiResponse::ok(rule)))
 }
 
+#[utoipa::path(
+    post,
+    path = "/api/v1/numbering-rules/{id}/generate",
+    params(("id" = Uuid, Path, description = "编号规则ID")),
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<GenerateNumberResp>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "编号规则"
+)]
 /// POST /api/v1/numbering-rules/:id/generate
 ///
 /// 根据编号规则生成新的编号。
@@ -117,6 +166,19 @@ where
     Ok(Json(ApiResponse::ok(result)))
 }
 
+#[utoipa::path(
+    delete,
+    path = "/api/v1/numbering-rules/{id}",
+    params(("id" = Uuid, Path, description = "编号规则ID")),
+    request_body = DeleteNumberingVersionReq,
+    responses(
+        (status = 200, description = "成功"),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "编号规则"
+)]
 /// DELETE /api/v1/numbering-rules/:id
 ///
 /// 软删除编号规则，设置 deleted_at 时间戳。
@@ -152,7 +214,7 @@ where
 }
 
 /// 删除编号规则的乐观锁版本号请求体。
-#[derive(Debug, serde::Deserialize)]
+#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
 pub struct DeleteNumberingVersionReq {
     pub version: i32,
 }