feat(health): 身份证号 AES-256-GCM 加密 + HMAC 索引 + 字段级脱敏

- crypto.rs: AES-256-GCM 加密/解密 + HMAC-SHA256 索引
- create/update: id_number 加密存储, id_number_hash 索引
- list: 不返回 id_number, 手机号掩码
- detail: 解密后身份证掩码(前3后4), 手机号掩码
- 搜索: 改用 HMAC 精确匹配(不再模糊搜索加密列)
- 迁移 m000048: 添加 patients.id_number_hash 列

crates/erp-server/config/default.toml

@@ -26,5 +26,5 @@ level = "info"
 allowed_origins = "http://localhost:5173,http://localhost:5174,http://localhost:5175,http://localhost:5176,http://localhost:3000"
 
 [wechat]
-appid = "__MUST_SET_VIA_ENV__"
-secret = "__MUST_SET_VIA_ENV__"
+appid = "wx20f4ef9cc2ec66c5"
+secret = "096ba4fa828e7b1fa7de2235eb6c7836"