feat(health+mp): S2-3 Patient DTO 最小化

后端:
- 新增 PatientSummary DTO（id/name/gender/birth_date/status 5 字段）
- 新增 GET /health/patients/summary 端点（权限 health.patient.list）
- patient_service::list_summaries 仅查询非敏感字段

前端:
- 新增 PatientSummary 类型 + getPatientSummaries() API
- auth store loadPatients 改用 summary 端点
- setCurrentPatient 仅存储非敏感字段到 secureSet

crates/erp-health/src/handler/patient_handler.rs

@@ -12,7 +12,7 @@ use erp_core::types::{ApiResponse, PaginatedResponse, TenantContext};
 use crate::dto::DeleteWithVersion;
 use crate::dto::patient_dto::{
     BatchImportPatientReq, BatchResultResp, BindByPhoneReq, BindResultResp, CreatePatientReq,
-    FamilyMemberReq, FamilyMemberResp, ManageTagsReq, PatientResp, ReferPatientReq,
+    FamilyMemberReq, FamilyMemberResp, ManageTagsReq, PatientResp, PatientSummary, ReferPatientReq,
     ReferResultResp, UpdatePatientReq,
 };
 use crate::service::patient_service;
@@ -57,6 +57,23 @@ where
     Ok(Json(ApiResponse::ok(result)))
 }
 
+/// GET /health/patients/summary — 患者摘要列表（字段最小化，不含敏感信息）
+pub async fn list_patient_summaries<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Query(params): Query<PatientListParams>,
+) -> Result<Json<ApiResponse<PaginatedResponse<PatientSummary>>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.patient.list")?;
+    let page = params.page.unwrap_or(1);
+    let page_size = params.page_size.unwrap_or(20).min(100);
+    let result = patient_service::list_summaries(&state, ctx.tenant_id, page, page_size).await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
 pub async fn create_patient<S>(
     State(state): State<HealthState>,
     Extension(ctx): Extension<TenantContext>,