fix(message): resolve Phase 5-6 audit findings

- Add missing version column to all message tables (migration + entities)
- Replace N+1 mark_all_read loop with single batch UPDATE query
- Fix NotificationList infinite re-render (extract queryFilter to stable ref)
- Fix NotificationPreferences dynamic import and remove unused Dayjs type
- Add Semaphore (max 8) to event listener for backpressure control
- Add /docs/openapi.json endpoint for API documentation
- Add permission check to unread_count handler
- Add version: Set(1) to all ActiveModel inserts

crates/erp-server/src/handlers/openapi.rs

@@ -0,0 +1,19 @@
+use axum::response::Json;
+use serde_json::Value;
+use utoipa::openapi::OpenApiBuilder;
+
+/// GET /docs/openapi.json
+///
+/// 返回 OpenAPI 3.0 规范 JSON 文档
+pub async fn openapi_spec() -> Json<Value> {
+    let mut info = utoipa::openapi::Info::new(
+        "ERP Platform API",
+        env!("CARGO_PKG_VERSION"),
+    );
+    info.description = Some("ERP 平台底座 REST API 文档".to_string());
+
+    let spec = OpenApiBuilder::new()
+        .info(info)
+        .build();
+    Json(serde_json::to_value(spec).unwrap_or_default())
+}