fix(health): 客户试用前全局审计修复 — P0 权限旁路 + API 路径 + 事件注册

P0 阻塞修复:
- 修复 PrivateRoute 权限旁路: p.startsWith('auth.') 匹配不到任何权限码,
  改为基于实际权限码的路由级检查 (user.manage/role.manage/organization.manage)
- 修复 deviceReadings API 路径: /patients/{id}/device-readings/daily 改为
  /vital-signs/daily?patient_id=, 消除 404

P1 重要修复:
- 补全事件注册表: 新增 auth(11) + config(8) + workflow(4) + plugin(2) = 25 条
- article_article_tag 联表新增 tenant_id + deleted_at + 审计列 (迁移 107)
- vital_signs_hourly 新增 deleted_at 支持软删除过滤 (迁移 108)
- 6 个页面添加权限守卫 (AlertDashboard/AlertRuleList/DeviceManage/
  AiAnalysisList/AiUsageDashboard)
- DialysisModule 声明 auth 依赖

crates/erp-health/src/entity/article_article_tag.rs

@@ -9,6 +9,11 @@ pub struct Model {
     pub article_id: Uuid,
     #[sea_orm(primary_key)]
     pub tag_id: Uuid,
+    pub tenant_id: Uuid,
+    #[sea_orm(skip_serializing_if = "Option::is_none")]
+    pub deleted_at: Option<DateTimeUtc>,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
 }
 
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]

crates/erp-health/src/entity/vital_signs_hourly.rs

@@ -16,6 +16,8 @@ pub struct Model {
     pub max_val: Option<f64>,
     pub avg_val: f64,
     pub sample_count: i32,
+    #[sea_orm(skip_serializing_if = "Option::is_none")]
+    pub deleted_at: Option<DateTimeUtc>,
     pub created_at: DateTimeUtc,
     pub updated_at: DateTimeUtc,
     pub version: i32,