feat: add utoipa path annotations to all API handlers and wire OpenAPI spec

- Add #[utoipa::path] annotations to all 70+ handler functions across
  auth, config, workflow, and message modules
- Add IntoParams/ToSchema derives to Pagination, PaginatedResponse, ApiResponse
  in erp-core, and MessageQuery/TemplateQuery in erp-message
- Collect all module paths into OpenAPI spec via AuthApiDoc, ConfigApiDoc,
  WorkflowApiDoc, MessageApiDoc structs in erp-server main.rs
- Update openapi_spec handler to merge all module specs
- The /docs/openapi.json endpoint now returns complete API documentation
  with all endpoints, request/response schemas, and security requirements

crates/erp-config/src/handler/dictionary_handler.rs

@@ -15,6 +15,18 @@ use crate::dto::{
 };
 use crate::service::dictionary_service::DictionaryService;
 
+#[utoipa::path(
+    get,
+    path = "/api/v1/dictionaries",
+    params(Pagination),
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<PaginatedResponse<DictionaryResp>>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "字典管理"
+)]
 /// GET /api/v1/dictionaries
 ///
 /// 分页查询当前租户下的字典列表。
@@ -47,6 +59,18 @@ where
     })))
 }
 
+#[utoipa::path(
+    post,
+    path = "/api/v1/dictionaries",
+    request_body = CreateDictionaryReq,
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<DictionaryResp>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "字典管理"
+)]
 /// POST /api/v1/dictionaries
 ///
 /// 在当前租户下创建新字典。
@@ -80,6 +104,19 @@ where
     Ok(Json(ApiResponse::ok(dictionary)))
 }
 
+#[utoipa::path(
+    put,
+    path = "/api/v1/dictionaries/{id}",
+    params(("id" = Uuid, Path, description = "字典ID")),
+    request_body = UpdateDictionaryReq,
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<DictionaryResp>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "字典管理"
+)]
 /// PUT /api/v1/dictionaries/:id
 ///
 /// 更新字典的可编辑字段（名称、描述）。
@@ -103,6 +140,19 @@ where
     Ok(Json(ApiResponse::ok(dictionary)))
 }
 
+#[utoipa::path(
+    delete,
+    path = "/api/v1/dictionaries/{id}",
+    params(("id" = Uuid, Path, description = "字典ID")),
+    request_body = DeleteVersionReq,
+    responses(
+        (status = 200, description = "成功"),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "字典管理"
+)]
 /// DELETE /api/v1/dictionaries/:id
 ///
 /// 软删除字典，设置 deleted_at 时间戳。
@@ -137,6 +187,18 @@ where
     }))
 }
 
+#[utoipa::path(
+    get,
+    path = "/api/v1/dictionaries/items-by-code",
+    params(("code" = String, Query, description = "字典编码")),
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<Vec<DictionaryItemResp>>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "字典管理"
+)]
 /// GET /api/v1/dictionaries/items-by-code?code=xxx
 ///
 /// 根据字典编码查询所有字典项。
@@ -159,6 +221,19 @@ where
     Ok(Json(ApiResponse::ok(items)))
 }
 
+#[utoipa::path(
+    post,
+    path = "/api/v1/dictionaries/{dict_id}/items",
+    params(("dict_id" = Uuid, Path, description = "字典ID")),
+    request_body = CreateDictionaryItemReq,
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<DictionaryItemResp>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "字典管理"
+)]
 /// POST /api/v1/dictionaries/:dict_id/items
 ///
 /// 向指定字典添加新的字典项。
@@ -185,6 +260,22 @@ where
     Ok(Json(ApiResponse::ok(item)))
 }
 
+#[utoipa::path(
+    put,
+    path = "/api/v1/dictionaries/{dict_id}/items/{item_id}",
+    params(
+        ("dict_id" = Uuid, Path, description = "字典ID"),
+        ("item_id" = Uuid, Path, description = "字典项ID"),
+    ),
+    request_body = UpdateDictionaryItemReq,
+    responses(
+        (status = 200, description = "成功", body = ApiResponse<DictionaryItemResp>),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "字典管理"
+)]
 /// PUT /api/v1/dictionaries/:dict_id/items/:item_id
 ///
 /// 更新字典项的可编辑字段（label、value、sort_order、color）。
@@ -213,6 +304,22 @@ where
     Ok(Json(ApiResponse::ok(item)))
 }
 
+#[utoipa::path(
+    delete,
+    path = "/api/v1/dictionaries/{dict_id}/items/{item_id}",
+    params(
+        ("dict_id" = Uuid, Path, description = "字典ID"),
+        ("item_id" = Uuid, Path, description = "字典项ID"),
+    ),
+    request_body = DeleteVersionReq,
+    responses(
+        (status = 200, description = "成功"),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "字典管理"
+)]
 /// DELETE /api/v1/dictionaries/:dict_id/items/:item_id
 ///
 /// 软删除字典项，设置 deleted_at 时间戳。
@@ -247,7 +354,7 @@ pub struct ItemsByCodeQuery {
 }
 
 /// 删除操作的乐观锁版本号。
-#[derive(Debug, serde::Deserialize)]
+#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
 pub struct DeleteVersionReq {
     pub version: i32,
 }