feat(core): add audit logging to all mutation operations

Create audit_log SeaORM entity and audit_service::record() helper.
Integrate audit recording into 35 mutation endpoints across all modules:
- erp-auth: user/role/organization/department/position CRUD (15 actions)
- erp-config: dictionary/menu/setting/numbering_rule CRUD (15 actions)
- erp-workflow: definition/instance/task operations (8 actions)
- erp-message: send/system/mark_read/delete (5 actions)

Uses fire-and-forget pattern — audit failures logged but non-blocking.

crates/erp-config/src/service/menu_service.rs

@@ -9,6 +9,8 @@ use uuid::Uuid;
 use crate::dto::{CreateMenuReq, MenuResp};
 use crate::entity::{menu, menu_role};
 use crate::error::{ConfigError, ConfigResult};
+use erp_core::audit::AuditLog;
+use erp_core::audit_service;
 use erp_core::error::check_version;
 use erp_core::events::EventBus;
 
@@ -156,6 +158,13 @@ impl MenuService {
             serde_json::json!({ "menu_id": id, "title": req.title }),
         ));
 
+        audit_service::record(
+            AuditLog::new(tenant_id, Some(operator_id), "menu.create", "menu")
+                .with_resource_id(id),
+            db,
+        )
+        .await;
+
         Ok(MenuResp {
             id,
             parent_id: req.parent_id,
@@ -225,6 +234,13 @@ impl MenuService {
             Self::assign_roles(id, role_ids, tenant_id, operator_id, db).await?;
         }
 
+        audit_service::record(
+            AuditLog::new(tenant_id, Some(operator_id), "menu.update", "menu")
+                .with_resource_id(id),
+            db,
+        )
+        .await;
+
         Ok(MenuResp {
             id: updated.id,
             parent_id: updated.parent_id,
@@ -275,6 +291,13 @@ impl MenuService {
             serde_json::json!({ "menu_id": id }),
         ));
 
+        audit_service::record(
+            AuditLog::new(tenant_id, Some(operator_id), "menu.delete", "menu")
+                .with_resource_id(id),
+            db,
+        )
+        .await;
+
         Ok(())
     }