feat(health): 行动收件箱后端 — ActionInboxService + Handler + 路由注册

- ActionInboxService: 三表 JOIN 聚合查询 ai_suggestion/ai_analysis/patient
- list_action_items: 分页列表，按 risk_level + created_at 排序
- get_action_thread: 线程时间线拼装 + 动态操作按钮
- ActionInboxHandler: 2 个 GET 端点，require_permission 权限守卫
- 路由: /health/action-inbox, /health/action-inbox/{source_ref}/thread
- 权限: health.action-inbox.list, health.action-inbox.manage

crates/erp-health/src/handler/action_inbox_handler.rs

@@ -0,0 +1,43 @@
+use axum::extract::{FromRef, Json, Path, Query, State};
+use axum::Extension;
+use erp_core::error::AppError;
+use erp_core::rbac::require_permission;
+use erp_core::types::{ApiResponse, PaginatedResponse, TenantContext};
+
+use crate::service::action_inbox_service::{
+    self, ActionInboxQuery, ActionItem, ThreadResponse,
+};
+use crate::state::HealthState;
+
+pub async fn list_action_inbox<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Query(query): Query<ActionInboxQuery>,
+) -> Result<Json<ApiResponse<PaginatedResponse<ActionItem>>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.action-inbox.list")?;
+    let result =
+        action_inbox_service::list_action_items(&state.db, ctx.tenant_id, &query).await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
+pub async fn get_action_thread<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(source_ref): Path<String>,
+) -> Result<Json<ApiResponse<ThreadResponse>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.action-inbox.list")?;
+    let result =
+        action_inbox_service::get_action_thread(&state.db, ctx.tenant_id, &source_ref).await?;
+    match result {
+        Some(resp) => Ok(Json(ApiResponse::ok(resp))),
+        None => Err(crate::error::HealthError::Validation("行动项未找到".into()).into()),
+    }
+}