feat(config): add system configuration module (Phase 3)

Implement the complete erp-config crate with:
- Data dictionaries (CRUD + items management)
- Dynamic menus (tree structure with role filtering)
- System settings (hierarchical: platform > tenant > org > user)
- Numbering rules (concurrency-safe via PostgreSQL advisory_lock)
- Theme and language configuration (via settings store)
- 6 database migrations (dictionaries, menus, settings, numbering_rules)
- Frontend Settings page with 5 tabs (dictionary, menu, numbering, settings, theme)

Refactor: move RBAC functions (require_permission) from erp-auth to erp-core
to avoid cross-module dependencies.

Add 20 new seed permissions for config module operations.

crates/erp-server/migration/src/m20260412_000014_create_menus.rs

@@ -0,0 +1,129 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(Menus::Table)
+                    .if_not_exists()
+                    .col(
+                        ColumnDef::new(Menus::Id)
+                            .uuid()
+                            .not_null()
+                            .primary_key(),
+                    )
+                    .col(ColumnDef::new(Menus::TenantId).uuid().not_null())
+                    .col(ColumnDef::new(Menus::ParentId).uuid().null())
+                    .col(ColumnDef::new(Menus::Title).string().not_null())
+                    .col(ColumnDef::new(Menus::Path).string().null())
+                    .col(ColumnDef::new(Menus::Icon).string().null())
+                    .col(
+                        ColumnDef::new(Menus::SortOrder)
+                            .integer()
+                            .not_null()
+                            .default(0),
+                    )
+                    .col(
+                        ColumnDef::new(Menus::Visible)
+                            .boolean()
+                            .not_null()
+                            .default(true),
+                    )
+                    .col(
+                        ColumnDef::new(Menus::MenuType)
+                            .string()
+                            .not_null()
+                            .default("page"),
+                    )
+                    .col(ColumnDef::new(Menus::Permission).string().null())
+                    .col(
+                        ColumnDef::new(Menus::CreatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        ColumnDef::new(Menus::UpdatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(ColumnDef::new(Menus::CreatedBy).uuid().not_null())
+                    .col(ColumnDef::new(Menus::UpdatedBy).uuid().not_null())
+                    .col(
+                        ColumnDef::new(Menus::DeletedAt)
+                            .timestamp_with_time_zone()
+                            .null(),
+                    )
+                    .col(
+                        ColumnDef::new(Menus::Version)
+                            .integer()
+                            .not_null()
+                            .default(1),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk_menus_parent")
+                            .from(Menus::Table, Menus::ParentId)
+                            .to(Menus::Table, Menus::Id)
+                            .on_delete(ForeignKeyAction::Cascade),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx_menus_tenant_id")
+                    .table(Menus::Table)
+                    .col(Menus::TenantId)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx_menus_parent_id")
+                    .table(Menus::Table)
+                    .col(Menus::ParentId)
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(Menus::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum Menus {
+    Table,
+    Id,
+    TenantId,
+    ParentId,
+    Title,
+    Path,
+    Icon,
+    SortOrder,
+    Visible,
+    MenuType,
+    Permission,
+    CreatedAt,
+    UpdatedAt,
+    CreatedBy,
+    UpdatedBy,
+    DeletedAt,
+    Version,
+}