fix(ai): 审计问题修复 — 错误映射/性能/SSE/依赖规范化

- C3: handler 中 .map_err(AppError::Internal) 改为 ? 操作符，
  利用 From<AiError> for AppError 实现正确的 HTTP 状态码映射
- H1: AiState 预构建在 AppState 初始化时，避免每次请求重建
  ClaudeProvider/AnalysisService/PromptService/UsageService
- H3: stream_analyze 的 user_id 参数传递到 created_by/updated_by
- H5: SSE 事件添加 .event("chunk"/"error"/"done") 类型字段
- L3: erp-ai Cargo.toml 依赖改用 workspace 引用
  (reqwest/handlebars/sha2/hex)
- 修复 erp-health 编译错误: points_handler 缺少 ColumnTrait 导入,
  points_service 版本字段部分移动问题

crates/erp-server/src/main.rs

@@ -427,6 +427,28 @@ async fn main() -> anyhow::Result<()> {
     // Extract JWT secret for middleware construction
     let jwt_secret = config.jwt.secret.clone();
 
+    // Pre-build AI state (avoids per-request reconstruction)
+    let ai_state = {
+        let mut provider = erp_ai::provider::claude::ClaudeProvider::new(
+            config.ai.api_key.clone(),
+        );
+        if let Some(ref base_url) = config.ai.base_url {
+            provider = provider.with_base_url(base_url.clone());
+        }
+        let analysis = std::sync::Arc::new(
+            erp_ai::service::analysis::AnalysisService::new(Box::new(provider), db.clone()),
+        );
+        let prompt = std::sync::Arc::new(erp_ai::service::prompt::PromptService::new(db.clone()));
+        let usage = std::sync::Arc::new(erp_ai::service::usage::UsageService::new(db.clone()));
+        erp_ai::AiState {
+            db: db.clone(),
+            event_bus: event_bus.clone(),
+            analysis,
+            prompt,
+            usage,
+        }
+    };
+
     // Build shared state
     let state = AppState {
         db,
@@ -440,6 +462,7 @@ async fn main() -> anyhow::Result<()> {
             .max_capacity(1000)
             .time_to_idle(std::time::Duration::from_secs(300))
             .build(),
+        ai_state,
     };
 
     // --- Build the router ---

crates/erp-server/src/state.rs

@@ -20,6 +20,8 @@ pub struct AppState {
     pub plugin_engine: erp_plugin::engine::PluginEngine,
     /// 插件实体缓存
     pub plugin_entity_cache: moka::sync::Cache<String, erp_plugin::state::EntityInfo>,
+    /// AI 模块状态（启动时构建，避免每次请求重建）
+    pub ai_state: erp_ai::AiState,
 }
 
 /// Allow handlers to extract `DatabaseConnection` directly from `State<AppState>`.
@@ -119,27 +121,6 @@ impl FromRef<AppState> for erp_health::HealthState {
 /// Allow erp-ai handlers to extract their required state.
 impl FromRef<AppState> for erp_ai::AiState {
     fn from_ref(state: &AppState) -> Self {
-        let mut provider = erp_ai::provider::claude::ClaudeProvider::new(
-            state.config.ai.api_key.clone(),
-        );
-        if let Some(ref base_url) = state.config.ai.base_url {
-            provider = provider.with_base_url(base_url.clone());
-        }
-        let db = state.db.clone();
-        let event_bus = state.event_bus.clone();
-
-        let analysis = std::sync::Arc::new(
-            erp_ai::service::analysis::AnalysisService::new(Box::new(provider), db.clone()),
-        );
-        let prompt = std::sync::Arc::new(erp_ai::service::prompt::PromptService::new(db.clone()));
-        let usage = std::sync::Arc::new(erp_ai::service::usage::UsageService::new(db.clone()));
-
-        Self {
-            db,
-            event_bus,
-            analysis,
-            prompt,
-            usage,
-        }
+        state.ai_state.clone()
     }
 }