feat(ai): Phase 2A-4 新增 3 个 Agent Tool — 化验报告/预约/用药查询

新增 3 个 AI Agent Tool 扩展医护沙箱能力：
- query_patient_lab_reports: 查询患者化验报告列表（含异常计数）
- query_patient_appointments: 查询患者即将到来的预约
- query_patient_medications: 查询患者当前用药列表

同时：
- HealthDataProvider trait 新增 get_patient_lab_reports 方法 + LabReportListItemDto
- erp-health 实现新 trait 方法（含 PII 解密）
- sandbox.rs 更新角色权限：Patient 可查体征/化验/用药，MedicalStaff 额外可查预约
- 修复 ai_prompt_tests.rs 中 AnalysisService::new 签名变更的遗留编译错误
- 新增 5 个 agent 测试覆盖新 Tool 和沙箱权限过滤

crates/erp-server/tests/integration/ai_prompt_tests.rs

@@ -346,7 +346,10 @@ async fn usage_cross_tenant_isolation() {
 #[tokio::test]
 async fn analysis_complete_updates_status() {
     let test_db = TestDb::new().await;
-    let svc = AnalysisService::new(Box::new(MockProvider), test_db.db().clone());
+    let svc = AnalysisService::new(
+        std::sync::Arc::new(erp_ai::provider::registry::ProviderRegistry::new()),
+        test_db.db().clone(),
+    );
     let tenant_id = uuid::Uuid::new_v4();
     let user_id = uuid::Uuid::new_v4();
     let patient_id = uuid::Uuid::new_v4();
@@ -379,7 +382,10 @@ async fn analysis_complete_updates_status() {
 #[tokio::test]
 async fn analysis_fail_updates_status() {
     let test_db = TestDb::new().await;
-    let svc = AnalysisService::new(Box::new(MockProvider), test_db.db().clone());
+    let svc = AnalysisService::new(
+        std::sync::Arc::new(erp_ai::provider::registry::ProviderRegistry::new()),
+        test_db.db().clone(),
+    );
     let tenant_id = uuid::Uuid::new_v4();
     let user_id = uuid::Uuid::new_v4();
     let patient_id = uuid::Uuid::new_v4();
@@ -407,7 +413,8 @@ async fn analysis_fail_updates_status() {
 #[tokio::test]
 async fn analysis_find_cached() {
     let test_db = TestDb::new().await;
-    let svc = AnalysisService::new(Box::new(MockProvider), test_db.db().clone());
+    let registry = std::sync::Arc::new(erp_ai::provider::registry::ProviderRegistry::new());
+    let svc = AnalysisService::new(registry, test_db.db().clone());
     let tenant_id = uuid::Uuid::new_v4();
     let user_id = uuid::Uuid::new_v4();
     let patient_id = uuid::Uuid::new_v4();
@@ -447,7 +454,8 @@ async fn analysis_find_cached() {
 #[tokio::test]
 async fn analysis_list_with_filters() {
     let test_db = TestDb::new().await;
-    let svc = AnalysisService::new(Box::new(MockProvider), test_db.db().clone());
+    let registry = std::sync::Arc::new(erp_ai::provider::registry::ProviderRegistry::new());
+    let svc = AnalysisService::new(registry, test_db.db().clone());
     let tenant_id = uuid::Uuid::new_v4();
     let user_id = uuid::Uuid::new_v4();
     let patient_a = uuid::Uuid::new_v4();