feat(config): add missing dictionary item CRUD, setting delete, and numbering delete routes

- Dictionary items: POST/PUT/DELETE endpoints under /config/dictionaries/{dict_id}/items
- Settings: DELETE /config/settings/{key}
- Numbering rules: DELETE /config/numbering-rules/{id}
- Fix workflow Entities: add deleted_at and version_field to process_definition,
  add standard fields to token and process_variable entities
- Update seed data for expanded permissions

crates/erp-config/src/handler/dictionary_handler.rs

@@ -10,7 +10,8 @@ use uuid::Uuid;
 
 use crate::config_state::ConfigState;
 use crate::dto::{
-    CreateDictionaryReq, DictionaryItemResp, DictionaryResp, UpdateDictionaryReq,
+    CreateDictionaryItemReq, CreateDictionaryReq, DictionaryItemResp, DictionaryResp,
+    UpdateDictionaryItemReq, UpdateDictionaryReq,
 };
 use crate::service::dictionary_service::DictionaryService;
 
@@ -156,6 +157,98 @@ where
     Ok(Json(ApiResponse::ok(items)))
 }
 
+/// POST /api/v1/dictionaries/:dict_id/items
+///
+/// 向指定字典添加新的字典项。
+/// 字典项的 value 在同一字典内必须唯一。
+/// 需要 `dictionary.create` 权限。
+pub async fn create_item<S>(
+    State(state): State<ConfigState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(dict_id): Path<Uuid>,
+    Json(req): Json<CreateDictionaryItemReq>,
+) -> Result<Json<ApiResponse<DictionaryItemResp>>, AppError>
+where
+    ConfigState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "dictionary.create")?;
+
+    req.validate()
+        .map_err(|e| AppError::Validation(e.to_string()))?;
+
+    let item = DictionaryService::add_item(
+        dict_id,
+        ctx.tenant_id,
+        ctx.user_id,
+        &req,
+        &state.db,
+    )
+    .await?;
+
+    Ok(Json(ApiResponse::ok(item)))
+}
+
+/// PUT /api/v1/dictionaries/:dict_id/items/:item_id
+///
+/// 更新字典项的可编辑字段（label、value、sort_order、color）。
+/// 需要 `dictionary.update` 权限。
+pub async fn update_item<S>(
+    State(state): State<ConfigState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path((dict_id, item_id)): Path<(Uuid, Uuid)>,
+    Json(req): Json<UpdateDictionaryItemReq>,
+) -> Result<Json<ApiResponse<DictionaryItemResp>>, AppError>
+where
+    ConfigState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "dictionary.update")?;
+
+    // 验证 item_id 属于 dict_id
+    let item = DictionaryService::update_item(
+        item_id,
+        ctx.tenant_id,
+        ctx.user_id,
+        &req,
+        &state.db,
+    )
+    .await?;
+
+    // 确保 item 属于指定的 dictionary
+    if item.dictionary_id != dict_id {
+        return Err(AppError::Validation(
+            "字典项不属于指定的字典".to_string(),
+        ));
+    }
+
+    Ok(Json(ApiResponse::ok(item)))
+}
+
+/// DELETE /api/v1/dictionaries/:dict_id/items/:item_id
+///
+/// 软删除字典项，设置 deleted_at 时间戳。
+/// 需要 `dictionary.delete` 权限。
+pub async fn delete_item<S>(
+    State(state): State<ConfigState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path((_dict_id, item_id)): Path<(Uuid, Uuid)>,
+) -> Result<Json<ApiResponse<()>>, AppError>
+where
+    ConfigState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "dictionary.delete")?;
+
+    DictionaryService::delete_item(item_id, ctx.tenant_id, ctx.user_id, &state.db).await?;
+
+    Ok(Json(ApiResponse {
+        success: true,
+        data: None,
+        message: Some("字典项已删除".to_string()),
+    }))
+}
+
 /// 按编码查询字典项的查询参数。
 #[derive(Debug, serde::Deserialize)]
 pub struct ItemsByCodeQuery {