feat(server): erp-ai 模块集成 — Config/State/路由注册

- 新增 AiConfig 到 AppConfig
- 新增 FromRef<AppState> for AiState
- 注册 AiModule 到 ModuleRegistry
- 合并 AI protected routes
- 修复 sync_module_permissions 只同步 health.% 的 bug

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

crates/erp-server/src/main.rs

@@ -343,13 +343,22 @@ async fn main() -> anyhow::Result<()> {
         "Health module initialized"
     );
 
+    // Initialize AI module
+    let ai_module = erp_ai::AiModule;
+    tracing::info!(
+        module = ai_module.name(),
+        version = ai_module.version(),
+        "AI module initialized"
+    );
+
     // Initialize module registry and register modules
     let registry = ModuleRegistry::new()
         .register(auth_module)
         .register(config_module)
         .register(workflow_module)
         .register(message_module)
-        .register(health_module);
+        .register(health_module)
+        .register(ai_module);
     tracing::info!(
         module_count = registry.modules().len(),
         "Modules registered"
@@ -464,6 +473,7 @@ async fn main() -> anyhow::Result<()> {
         .merge(erp_message::MessageModule::protected_routes())
         .merge(erp_plugin::module::PluginModule::protected_routes())
         .merge(erp_health::HealthModule::protected_routes())
+        .merge(erp_ai::AiModule::protected_routes())
         .merge(handlers::audit_log::audit_log_router())
         .layer(axum::middleware::from_fn_with_state(
             state.clone(),
@@ -627,7 +637,7 @@ async fn sync_module_permissions(
                SELECT r.id, p.id, p.tenant_id, 'all', NOW(), NOW(), $1, $1, NULL, 1
                FROM permissions p
                JOIN roles r ON r.code = 'admin' AND r.tenant_id = p.tenant_id AND r.deleted_at IS NULL
-               WHERE p.tenant_id = $2 AND p.code LIKE 'health.%'
+               WHERE p.tenant_id = $2
                ON CONFLICT DO NOTHING"#,
             [system_user_id.into(), tenant_id.into()],
         )).await?;