feat(ai): Copilot 评分引擎 + Handler + 路由 + 权限码

- scoring.rs: 混合评分 (calculate_risk) + RiskScore/MatchedRule 结构
- engine.rs: CopilotEngine 协调规则评估和评分
- risk_service.rs: 风险计算 + UPSERT 快照 + 规则加载
- insight_service.rs: 洞察 CRUD + 过期清理
- 3 个 Handler: insight/risk/rule，7 个 API 端点
- 5 个权限码: copilot.insights.list/manage, copilot.risk.view, copilot.rules.list/manage
- AiState 扩展 risk_service + insight_service

crates/erp-ai/src/handler/risk_handler.rs

@@ -0,0 +1,29 @@
+use axum::Json;
+use axum::extract::{Extension, FromRef, Path, State};
+use erp_core::rbac::require_permission;
+use erp_core::types::{ApiResponse, TenantContext};
+
+use crate::state::AiState;
+
+pub async fn get_patient_risk<S>(
+    State(state): State<AiState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(patient_id): Path<uuid::Uuid>,
+) -> Result<Json<ApiResponse<serde_json::Value>>, erp_core::error::AppError>
+where
+    AiState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "copilot.risk.view")?;
+
+    let risk = crate::service::risk_service::RiskService::compute_risk(
+        &state.db,
+        ctx.tenant_id,
+        patient_id,
+    )
+    .await?;
+
+    Ok(Json(ApiResponse::ok(serde_json::to_value(&risk).map_err(
+        |e| erp_core::error::AppError::Internal(e.to_string()),
+    )?)))
+}