完全移除模块级权限系统，迁移至接口级权限

后端：
- 删除 StudyRolePermission 模型和 project_permissions API 文件
- 重写 project_permissions.py core，移除所有模块级权限函数
- 重写 permission_cache.py，移除模块级权限缓存逻辑
- 新增权限模板功能（PermissionTemplate 模型、API、服务层）
- 新增 permission_templates 数据库迁移
- 迁移 8 个模块（attachments、audit_logs、dashboard、faqs、
  faq_categories、fees_attachments、knowledge_notes、
  material_equipments、overview、subject_histories、subject_pds）
  至接口级权限检查
- 删除所有模块级权限相关测试文件，新增权限模板测试

前端：
- 删除 ProjectPermissions.vue 和 ProjectPermissionsModule.vue
- 重写 projectRoutePermissions.ts，改为基于接口级权限格式
- 更新 store/study.ts、router/index.ts、AuditLogs.vue、Projects.vue
  中的权限 API 调用，从 fetchProjectRolePermissions 改为
  fetchApiEndpointPermissions
- 清理 types/api.ts 中的旧模块级权限类型定义
- 新增 PermissionTemplateSelector.vue 组件
- 更新权限管理页面，移除模块级权限 tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/api/v1/attachments.py

@@ -8,8 +8,8 @@ from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status,
 from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, get_study_member, require_study_not_locked
-from app.core.project_permissions import role_has_project_permission
+from app.core.deps import get_current_user, get_db_session, get_study_member, require_study_not_locked, require_api_permission
+from app.core.project_permissions import role_has_api_permission
 from app.crud import attachment as attachment_crud
 from app.crud import audit as audit_crud
 from app.crud import study as study_crud
@@ -23,9 +23,6 @@ router = APIRouter()
 global_router = APIRouter()
 
 UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
-ATTACHMENT_PERMISSION_MODULE_BY_ENTITY = {
-    "knowledge_note": "shared_library",
-}
 
 
 def _content_disposition(filename: str, disposition: str = "inline") -> str:
@@ -41,39 +38,14 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     return study
 
 
-def _permission_module_for_entity(entity_type: str) -> str:
-    return ATTACHMENT_PERMISSION_MODULE_BY_ENTITY.get(entity_type, "file_versions")
-
-
-async def _ensure_attachment_permission(
-    db: AsyncSession,
-    study_id: uuid.UUID,
-    current_user,
-    entity_type: str,
-    action: str,
-) -> None:
-    role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
-    if role_value == "ADMIN":
-        return
-    membership = await member_crud.get_member(db, study_id, current_user.id)
-    if not membership or not membership.is_active:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
-    allowed = await role_has_project_permission(
-        db,
-        study_id,
-        membership.role_in_study,
-        _permission_module_for_entity(entity_type),
-        action,
-    )
-    if not allowed:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
-
-
 @router.post(
     "/",
     response_model=AttachmentRead,
     status_code=status.HTTP_201_CREATED,
-    dependencies=[Depends(require_study_not_locked())],
+    dependencies=[
+        Depends(require_api_permission("attachments:create")),
+        Depends(require_study_not_locked())
+    ],
 )
 async def upload_attachment(
     study_id: uuid.UUID,
@@ -84,7 +56,6 @@ async def upload_attachment(
     current_user=Depends(get_current_user),
 ) -> AttachmentRead:
     await _ensure_study_exists(db, study_id)
-    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "write")
     dest_dir = UPLOAD_ROOT / f"study_{study_id}" / f"{entity_type}_{entity_id}"
     dest_dir.mkdir(parents=True, exist_ok=True)
     unique_name = f"{uuid.uuid4()}{Path(file.filename).suffix}"
@@ -129,6 +100,7 @@ async def upload_attachment(
 @router.get(
     "/",
     response_model=list[AttachmentRead],
+    dependencies=[Depends(require_api_permission("attachments:read"))],
 )
 async def list_attachments(
     study_id: uuid.UUID,
@@ -138,7 +110,6 @@ async def list_attachments(
     current_user=Depends(get_current_user),
 ) -> list[AttachmentRead]:
     await _ensure_study_exists(db, study_id)
-    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
     attachments = await attachment_crud.list_attachments(db, study_id, entity_type, entity_id)
     user_ids = {a.uploaded_by for a in attachments if a.uploaded_by}
     users_map = await user_crud.get_users_by_ids(db, user_ids)
@@ -161,6 +132,7 @@ async def list_attachments(
 
 @router.get(
     "/{attachment_id}/download",
+    dependencies=[Depends(require_api_permission("attachments:read"))],
 )
 async def download_attachment(
     study_id: uuid.UUID,
@@ -171,7 +143,6 @@ async def download_attachment(
     current_user=Depends(get_current_user),
 ) -> FileResponse:
     await _ensure_study_exists(db, study_id)
-    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -187,6 +158,7 @@ async def download_attachment(
 
 @router.get(
     "/{attachment_id}/preview",
+    dependencies=[Depends(require_api_permission("attachments:read"))],
 )
 async def preview_attachment(
     study_id: uuid.UUID,
@@ -197,7 +169,6 @@ async def preview_attachment(
     current_user=Depends(get_current_user),
 ) -> FileResponse:
     await _ensure_study_exists(db, study_id)
-    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -250,12 +221,12 @@ async def global_download_attachment(
     if user.role != "ADMIN":
         membership = await get_study_member(attachment.study_id, current_user=user, db=db)
     if user.role != "ADMIN":
-        allowed = await role_has_project_permission(
+        allowed = await role_has_api_permission(
             db,
             attachment.study_id,
             membership.role_in_study if membership else None,
-            _permission_module_for_entity(attachment.entity_type),
-            "read",
+            "attachments:read",
+            check_prerequisites=False,
         )
         if not allowed:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
@@ -284,12 +255,12 @@ async def global_preview_attachment(
     await _ensure_study_exists(db, attachment.study_id)
     user, membership = await _authorize_global(request, db, attachment.study_id)
     if user.role != "ADMIN":
-        allowed = await role_has_project_permission(
+        allowed = await role_has_api_permission(
             db,
             attachment.study_id,
             membership.role_in_study if membership else None,
-            _permission_module_for_entity(attachment.entity_type),
-            "read",
+            "attachments:read",
+            check_prerequisites=False,
         )
         if not allowed:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
@@ -318,12 +289,12 @@ async def global_delete_attachment(
     await _ensure_study_exists(db, attachment.study_id)
     user, membership = await _authorize_global(request, db, attachment.study_id)
     if user.role != "ADMIN":
-        allowed = await role_has_project_permission(
+        allowed = await role_has_api_permission(
             db,
             attachment.study_id,
             membership.role_in_study if membership else None,
-            _permission_module_for_entity(attachment.entity_type),
-            "write",
+            "attachments:delete",
+            check_prerequisites=False,
         )
         if not allowed:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
@@ -350,7 +321,10 @@ async def global_delete_attachment(
 @router.delete(
     "/{attachment_id}",
     status_code=status.HTTP_204_NO_CONTENT,
-    dependencies=[Depends(require_study_not_locked())],
+    dependencies=[
+        Depends(require_api_permission("attachments:delete")),
+        Depends(require_study_not_locked())
+    ],
 )
 async def delete_attachment(
     study_id: uuid.UUID,
@@ -361,7 +335,6 @@ async def delete_attachment(
     current_user=Depends(get_current_user),
 ):
     await _ensure_study_exists(db, study_id)
-    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "write")
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if (
         not attachment