完全移除模块级权限系统，迁移至接口级权限

后端：
- 删除 StudyRolePermission 模型和 project_permissions API 文件
- 重写 project_permissions.py core，移除所有模块级权限函数
- 重写 permission_cache.py，移除模块级权限缓存逻辑
- 新增权限模板功能（PermissionTemplate 模型、API、服务层）
- 新增 permission_templates 数据库迁移
- 迁移 8 个模块（attachments、audit_logs、dashboard、faqs、
  faq_categories、fees_attachments、knowledge_notes、
  material_equipments、overview、subject_histories、subject_pds）
  至接口级权限检查
- 删除所有模块级权限相关测试文件，新增权限模板测试

前端：
- 删除 ProjectPermissions.vue 和 ProjectPermissionsModule.vue
- 重写 projectRoutePermissions.ts，改为基于接口级权限格式
- 更新 store/study.ts、router/index.ts、AuditLogs.vue、Projects.vue
  中的权限 API 调用，从 fetchProjectRolePermissions 改为
  fetchApiEndpointPermissions
- 清理 types/api.ts 中的旧模块级权限类型定义
- 新增 PermissionTemplateSelector.vue 组件
- 更新权限管理页面，移除模块级权限 tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_migrated_endpoints_batch3.py

@@ -9,7 +9,6 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.project_permissions import role_has_api_permission
 from app.models.api_endpoint_permission import ApiEndpointPermission
-from app.models.study_role_permission import StudyRolePermission
 
 
 # ============================================================================
@@ -538,135 +537,3 @@ async def test_project_permissions_denied_for_cra(db_session: AsyncSession):
 
     allowed = await role_has_api_permission(db_session, study_id, "CRA", "PUT:/studies/{study_id}/permissions")
     assert allowed is False
-
-
-# ============================================================================
-# 向后兼容性测试
-# ============================================================================
-
-@pytest.mark.asyncio
-async def test_backward_compatibility_startup_module_level(db_session: AsyncSession):
-    """验证startup模块的模块级权限回退仍然有效"""
-    study_id = uuid.uuid4()
-    db_session.add(StudyRolePermission(
-        study_id=study_id,
-        role="PM",
-        module="startup",
-        can_read=True,
-        can_write=True,
-    ))
-    await db_session.commit()
-
-    allowed = await role_has_api_permission(db_session, study_id, "PM", "POST:/studies/{study_id}/startup/ethics")
-    assert allowed is True
-
-
-@pytest.mark.asyncio
-async def test_backward_compatibility_drug_shipments_module_level(db_session: AsyncSession):
-    """验证drug_shipments模块的模块级权限回退仍然有效"""
-    study_id = uuid.uuid4()
-    db_session.add(StudyRolePermission(
-        study_id=study_id,
-        role="IMP",
-        module="drug_shipments",
-        can_read=True,
-        can_write=True,
-    ))
-    await db_session.commit()
-
-    allowed = await role_has_api_permission(db_session, study_id, "IMP", "POST:/studies/{study_id}/drug-shipments")
-    assert allowed is True
-
-
-@pytest.mark.asyncio
-async def test_api_permission_priority_over_module_startup(db_session: AsyncSession):
-    """验证startup模块的接口级权限优先于模块级权限"""
-    study_id = uuid.uuid4()
-
-    db_session.add(StudyRolePermission(
-        study_id=study_id,
-        role="PM",
-        module="startup",
-        can_read=True,
-        can_write=True,
-    ))
-
-    db_session.add(ApiEndpointPermission(
-        study_id=study_id,
-        role="PM",
-        endpoint_key="POST:/studies/{study_id}/startup/ethics",
-        allowed=False,
-    ))
-    await db_session.commit()
-
-    allowed = await role_has_api_permission(db_session, study_id, "PM", "POST:/studies/{study_id}/startup/ethics")
-    assert allowed is False
-
-
-@pytest.mark.asyncio
-async def test_api_permission_priority_over_module_materials(db_session: AsyncSession):
-    """验证material_equipments模块的接口级权限优先于模块级权限"""
-    study_id = uuid.uuid4()
-
-    db_session.add(StudyRolePermission(
-        study_id=study_id,
-        role="IMP",
-        module="material_equipments",
-        can_read=True,
-        can_write=True,
-    ))
-
-    db_session.add(ApiEndpointPermission(
-        study_id=study_id,
-        role="IMP",
-        endpoint_key="POST:/studies/{study_id}/materials",
-        allowed=False,
-    ))
-    await db_session.commit()
-
-    allowed = await role_has_api_permission(db_session, study_id, "IMP", "POST:/studies/{study_id}/materials")
-    assert allowed is False
-
-
-# ============================================================================
-# 权限矩阵一致性测试
-# ============================================================================
-
-@pytest.mark.asyncio
-async def test_permission_matrix_consistency_batch3(db_session: AsyncSession):
-    """验证第3批模块的权限矩阵一致性"""
-    study_id = uuid.uuid4()
-
-    # 为多个模块设置权限
-    perms = [
-        ApiEndpointPermission(study_id=study_id, role="PM", endpoint_key="POST:/studies/{study_id}/startup/ethics", allowed=True),
-        ApiEndpointPermission(study_id=study_id, role="PM", endpoint_key="GET:/studies/{study_id}/permissions", allowed=True),
-        ApiEndpointPermission(study_id=study_id, role="IMP", endpoint_key="POST:/studies/{study_id}/drug-shipments", allowed=True),
-        ApiEndpointPermission(study_id=study_id, role="CRA", endpoint_key="POST:/studies/{study_id}/subjects/{subject_id}/pds", allowed=True),
-    ]
-    for perm in perms:
-        db_session.add(perm)
-    await db_session.commit()
-
-    # 验证所有权限都正确设置
-    assert await role_has_api_permission(db_session, study_id, "PM", "POST:/studies/{study_id}/startup/ethics") is True
-    assert await role_has_api_permission(db_session, study_id, "PM", "GET:/studies/{study_id}/permissions") is True
-    assert await role_has_api_permission(db_session, study_id, "IMP", "POST:/studies/{study_id}/drug-shipments") is True
-    assert await role_has_api_permission(db_session, study_id, "CRA", "POST:/studies/{study_id}/subjects/{subject_id}/pds") is True
-
-
-@pytest.mark.asyncio
-async def test_admin_always_allowed_batch3(db_session: AsyncSession):
-    """验证ADMIN角色总是被允许访问第3批模块的所有端点"""
-    study_id = uuid.uuid4()
-
-    endpoints = [
-        "POST:/studies/{study_id}/startup/ethics",
-        "GET:/studies/{study_id}/permissions",
-        "POST:/studies/{study_id}/drug-shipments",
-        "POST:/studies/{study_id}/materials",
-    ]
-
-    for endpoint in endpoints:
-        allowed = await role_has_api_permission(db_session, study_id, "ADMIN", endpoint)
-        assert allowed is True, f"ADMIN should be allowed for {endpoint}"