feat(workflow): add workflow engine module (Phase 4)

Implement complete workflow engine with BPMN subset support:

Backend (erp-workflow crate):
- Token-driven execution engine with exclusive/parallel gateway support
- BPMN parser with flow graph validation
- Expression evaluator for conditional branching
- Process definition CRUD with draft/publish lifecycle
- Process instance management (start, suspend, terminate)
- Task service (pending, complete, delegate)
- PostgreSQL advisory locks for concurrent safety
- 5 database tables: process_definitions, process_instances,
  tokens, tasks, process_variables
- 13 API endpoints with RBAC protection
- Timeout checker framework (placeholder)

Frontend:
- Workflow page with 4 tabs (definitions, pending, completed, monitor)
- React Flow visual process designer (@xyflow/react)
- Process viewer with active node highlighting
- 3 API client modules for workflow endpoints
- Sidebar menu integration

crates/erp-workflow/src/entity/mod.rs

@@ -0,0 +1,5 @@
+pub mod process_definition;
+pub mod process_instance;
+pub mod token;
+pub mod task;
+pub mod process_variable;

crates/erp-workflow/src/entity/process_definition.rs

@@ -0,0 +1,40 @@
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "process_definitions")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    pub tenant_id: Uuid,
+    pub name: String,
+    pub key: String,
+    pub version: i32,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub category: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    pub nodes: serde_json::Value,
+    pub edges: serde_json::Value,
+    pub status: String,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    pub created_by: Uuid,
+    pub updated_by: Uuid,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deleted_at: Option<DateTimeUtc>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(has_many = "super::process_instance::Entity")]
+    ProcessInstance,
+}
+
+impl Related<super::process_instance::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProcessInstance.def()
+    }
+}
+
+impl ActiveModelBehavior for ActiveModel {}

crates/erp-workflow/src/entity/process_instance.rs

@@ -0,0 +1,59 @@
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "process_instances")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    pub tenant_id: Uuid,
+    pub definition_id: Uuid,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub business_key: Option<String>,
+    pub status: String,
+    pub started_by: Uuid,
+    pub started_at: DateTimeUtc,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub completed_at: Option<DateTimeUtc>,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    pub created_by: Uuid,
+    pub updated_by: Uuid,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deleted_at: Option<DateTimeUtc>,
+    pub version: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::process_definition::Entity",
+        from = "Column::DefinitionId",
+        to = "super::process_definition::Column::Id"
+    )]
+    ProcessDefinition,
+    #[sea_orm(has_many = "super::token::Entity")]
+    Token,
+    #[sea_orm(has_many = "super::task::Entity")]
+    Task,
+}
+
+impl Related<super::process_definition::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProcessDefinition.def()
+    }
+}
+
+impl Related<super::token::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Token.def()
+    }
+}
+
+impl Related<super::task::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Task.def()
+    }
+}
+
+impl ActiveModelBehavior for ActiveModel {}

crates/erp-workflow/src/entity/process_variable.rs

@@ -0,0 +1,39 @@
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "process_variables")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    pub tenant_id: Uuid,
+    pub instance_id: Uuid,
+    pub name: String,
+    pub var_type: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub value_string: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub value_number: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub value_boolean: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub value_date: Option<DateTimeUtc>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::process_instance::Entity",
+        from = "Column::InstanceId",
+        to = "super::process_instance::Column::Id"
+    )]
+    ProcessInstance,
+}
+
+impl Related<super::process_instance::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProcessInstance.def()
+    }
+}
+
+impl ActiveModelBehavior for ActiveModel {}

crates/erp-workflow/src/entity/task.rs

@@ -0,0 +1,65 @@
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "tasks")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    pub tenant_id: Uuid,
+    pub instance_id: Uuid,
+    pub token_id: Uuid,
+    pub node_id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub node_name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub assignee_id: Option<Uuid>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub candidate_groups: Option<serde_json::Value>,
+    pub status: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub outcome: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub form_data: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub due_date: Option<DateTimeUtc>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub completed_at: Option<DateTimeUtc>,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    pub created_by: Uuid,
+    pub updated_by: Uuid,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deleted_at: Option<DateTimeUtc>,
+    pub version: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::process_instance::Entity",
+        from = "Column::InstanceId",
+        to = "super::process_instance::Column::Id"
+    )]
+    ProcessInstance,
+    #[sea_orm(
+        belongs_to = "super::token::Entity",
+        from = "Column::TokenId",
+        to = "super::token::Column::Id"
+    )]
+    Token,
+}
+
+impl Related<super::process_instance::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProcessInstance.def()
+    }
+}
+
+impl Related<super::token::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Token.def()
+    }
+}
+
+impl ActiveModelBehavior for ActiveModel {}

crates/erp-workflow/src/entity/token.rs

@@ -0,0 +1,34 @@
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "tokens")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    pub tenant_id: Uuid,
+    pub instance_id: Uuid,
+    pub node_id: String,
+    pub status: String,
+    pub created_at: DateTimeUtc,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub consumed_at: Option<DateTimeUtc>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::process_instance::Entity",
+        from = "Column::InstanceId",
+        to = "super::process_instance::Column::Id"
+    )]
+    ProcessInstance,
+}
+
+impl Related<super::process_instance::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProcessInstance.def()
+    }
+}
+
+impl ActiveModelBehavior for ActiveModel {}