feat: 审计修复 Phase 6-7 — SSE 推送/工作流补全/消息群发/前端收尾

Phase 6 功能补全:
- P1-3: 消息 SSE 实时推送端点 + 前端 EventSource 连接
- P1-6: ServiceTask HTTP 调用能力 (reqwest GET/POST)
- P1-7: user.deleted 事件处理 — 终止相关流程实例
- P1-8: 任务认领 (claim) 端点 + handler
- P1-9: 超时检查器发布 task.timeout 事件
- P1-15: 组织/部门名称唯一性校验 (create + update)
- P1-18: 消息群发 fan-out (role/department/all 批量投递)

Phase 7 P3-P4 收尾:
- PluginAdmin purge 按钮状态修复
- ChangePassword 最小 8 字符 + 新旧密码不同验证
- AuditLogViewer 用户名缓存 + 扩展资源类型
- InstanceMonitor 通过 definition 缓存解析 node_name
- NotificationPreferences DND 时间范围校验

crates/erp-auth/src/service/dept_service.rs

@@ -81,6 +81,19 @@ impl DeptService {
             }
         }
 
+        // Check name uniqueness within the same organization
+        let name_exists = department::Entity::find()
+            .filter(department::Column::TenantId.eq(tenant_id))
+            .filter(department::Column::OrgId.eq(org_id))
+            .filter(department::Column::Name.eq(&req.name))
+            .filter(department::Column::DeletedAt.is_null())
+            .one(db)
+            .await
+            .map_err(|e| AuthError::Validation(e.to_string()))?;
+        if name_exists.is_some() {
+            return Err(AuthError::Validation("部门名称已存在".to_string()));
+        }
+
         // Compute path from parent department or organization root
         let path = if let Some(parent_id) = req.parent_id {
             let parent = department::Entity::find_by_id(parent_id)
@@ -192,6 +205,24 @@ impl DeptService {
             }
         }
 
+        // If name is being changed, check uniqueness within the same org (exclude self)
+        if let Some(ref new_name) = req.name
+            && new_name != &model.name
+        {
+            let name_exists = department::Entity::find()
+                .filter(department::Column::TenantId.eq(tenant_id))
+                .filter(department::Column::OrgId.eq(model.org_id))
+                .filter(department::Column::Name.eq(new_name.as_str()))
+                .filter(department::Column::DeletedAt.is_null())
+                .filter(department::Column::Id.ne(id))
+                .one(db)
+                .await
+                .map_err(|e| AuthError::Validation(e.to_string()))?;
+            if name_exists.is_some() {
+                return Err(AuthError::Validation("部门名称已存在".to_string()));
+            }
+        }
+
         let next_ver = check_version(req.version, model.version)
             .map_err(|e| AuthError::Validation(e.to_string()))?;
 

crates/erp-auth/src/service/org_service.rs

@@ -69,6 +69,18 @@ impl OrgService {
             }
         }
 
+        // Check name uniqueness within tenant
+        let name_exists = organization::Entity::find()
+            .filter(organization::Column::TenantId.eq(tenant_id))
+            .filter(organization::Column::Name.eq(&req.name))
+            .filter(organization::Column::DeletedAt.is_null())
+            .one(db)
+            .await
+            .map_err(|e| AuthError::Validation(e.to_string()))?;
+        if name_exists.is_some() {
+            return Err(AuthError::Validation("组织名称已存在".to_string()));
+        }
+
         let (path, level) = if let Some(parent_id) = req.parent_id {
             let parent = organization::Entity::find_by_id(parent_id)
                 .one(db)
@@ -174,6 +186,23 @@ impl OrgService {
             }
         }
 
+        // If name is being changed, check uniqueness (exclude self)
+        if let Some(ref new_name) = req.name
+            && new_name != &model.name
+        {
+            let name_exists = organization::Entity::find()
+                .filter(organization::Column::TenantId.eq(tenant_id))
+                .filter(organization::Column::Name.eq(new_name.as_str()))
+                .filter(organization::Column::DeletedAt.is_null())
+                .filter(organization::Column::Id.ne(id))
+                .one(db)
+                .await
+                .map_err(|e| AuthError::Validation(e.to_string()))?;
+            if name_exists.is_some() {
+                return Err(AuthError::Validation("组织名称已存在".to_string()));
+            }
+        }
+
         let next_ver = check_version(req.version, model.version)
             .map_err(|e| AuthError::Validation(e.to_string()))?;