feat(health): P0 平台基座回顾 — 7项上线前必修

P0-1: 危急值告警消费者 — health_data.critical_alert 事件推送给责任医护
P0-2: 危急值阈值可配置化 — 硬编码改为数据库配置(critical_value_threshold表)，支持科室/年龄差异化
P0-3: daily_monitoring合并后告警验证 — update_vital_signs也触发危急值检测
P0-4: 随访逾期通知+幂等保护 — 只通知本次新标记的逾期任务，避免重复
P0-5: 知情同意记录(consent) — 新增实体/迁移/Service/Handler，PIPL合规
P0-6: 审计日志补全 — 患者更新记录前后值(过敏史/病史/状态变更)
P0-7: EventBus持久化增强 — 两阶段提交(pending→published)+启动时outbox relay恢复

crates/erp-health/src/handler/consent_handler.rs

@@ -0,0 +1,71 @@
+use axum::Extension;
+use axum::extract::{FromRef, Json, Path, Query, State};
+use serde::Deserialize;
+use erp_core::error::AppError;
+use erp_core::rbac::require_permission;
+use erp_core::types::{ApiResponse, PaginatedResponse, TenantContext};
+
+use crate::dto::consent_dto::*;
+use crate::service::consent_service;
+use crate::state::HealthState;
+
+#[derive(Debug, Deserialize)]
+pub struct ConsentListParams {
+    pub page: Option<u64>,
+    pub page_size: Option<u64>,
+}
+
+pub async fn list_consents<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(patient_id): Path<uuid::Uuid>,
+    Query(params): Query<ConsentListParams>,
+) -> Result<Json<ApiResponse<PaginatedResponse<ConsentResp>>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.patient.list")?;
+    let page = params.page.unwrap_or(1);
+    let page_size = params.page_size.unwrap_or(20);
+    let result = consent_service::list_consents(
+        &state, ctx.tenant_id, patient_id, page, page_size,
+    )
+    .await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
+pub async fn grant_consent<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Json(req): Json<CreateConsentReq>,
+) -> Result<Json<ApiResponse<ConsentResp>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.patient.manage")?;
+    let result = consent_service::grant_consent(
+        &state, ctx.tenant_id, Some(ctx.user_id), req,
+    )
+    .await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
+pub async fn revoke_consent<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(consent_id): Path<uuid::Uuid>,
+    Json(req): Json<RevokeConsentReq>,
+) -> Result<Json<ApiResponse<ConsentResp>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.patient.manage")?;
+    let result = consent_service::revoke_consent(
+        &state, ctx.tenant_id, consent_id, Some(ctx.user_id), req,
+    )
+    .await?;
+    Ok(Json(ApiResponse::ok(result)))
+}