完全移除模块级权限系统，迁移至接口级权限

后端：
- 删除 StudyRolePermission 模型和 project_permissions API 文件
- 重写 project_permissions.py core，移除所有模块级权限函数
- 重写 permission_cache.py，移除模块级权限缓存逻辑
- 新增权限模板功能（PermissionTemplate 模型、API、服务层）
- 新增 permission_templates 数据库迁移
- 迁移 8 个模块（attachments、audit_logs、dashboard、faqs、
  faq_categories、fees_attachments、knowledge_notes、
  material_equipments、overview、subject_histories、subject_pds）
  至接口级权限检查
- 删除所有模块级权限相关测试文件，新增权限模板测试

前端：
- 删除 ProjectPermissions.vue 和 ProjectPermissionsModule.vue
- 重写 projectRoutePermissions.ts，改为基于接口级权限格式
- 更新 store/study.ts、router/index.ts、AuditLogs.vue、Projects.vue
  中的权限 API 调用，从 fetchProjectRolePermissions 改为
  fetchApiEndpointPermissions
- 清理 types/api.ts 中的旧模块级权限类型定义
- 新增 PermissionTemplateSelector.vue 组件
- 更新权限管理页面，移除模块级权限 tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/router/index.ts

@@ -4,7 +4,7 @@ import { useStudyStore } from "../store/study";
 import { isSystemAdmin } from "../utils/roles";
 import { findFirstAccessibleProjectPath, getProjectRoutePermission, hasProjectPermission } from "../utils/projectRoutePermissions";
 import { fetchStudyDetail } from "../api/studies";
-import { fetchProjectRolePermissions } from "../api/projectPermissions";
+import { fetchApiEndpointPermissions } from "../api/projectPermissions";
 import Layout from "../components/Layout.vue";
 import Login from "../views/Login.vue";
 import Register from "../views/Register.vue";
@@ -19,7 +19,6 @@ import AdminProjects from "../views/admin/Projects.vue";
 import ProjectMembers from "../views/admin/ProjectMembers.vue";
 import AdminSites from "../views/admin/Sites.vue";
 import ProjectDetail from "../views/admin/ProjectDetail.vue";
-import ProjectPermissions from "../views/admin/ProjectPermissions.vue";
 import ApiPermissions from "../views/admin/ApiPermissions.vue";
 import ProfileSettings from "../views/ProfileSettings.vue";
 import ProjectOverview from "../views/ia/ProjectOverview.vue";
@@ -442,12 +441,6 @@ const routes: RouteRecordRaw[] = [
         component: ProjectMembers,
         meta: { title: TEXT.modules.adminProjectMembers.memberLabel, adminProjectPermission: { module: "project_members", action: "read" } },
       },
-      {
-        path: "projects/:projectId/permissions",
-        name: "AdminProjectPermissions",
-        component: ProjectPermissions,
-        meta: { title: "权限管理", adminProjectPermission: { module: "project_members", action: "write" } },
-      },
       {
         path: "projects/:id/api-permissions",
         name: "AdminApiPermissions",
@@ -489,7 +482,7 @@ const ensureAdminProjectAccess = async (to: any, isAdmin: boolean) => {
   if (routeProjectId && studyStore.currentStudy?.id !== routeProjectId) {
     const [{ data: project }, { data: permissions }] = await Promise.all([
       fetchStudyDetail(routeProjectId),
-      fetchProjectRolePermissions(routeProjectId),
+      fetchApiEndpointPermissions(routeProjectId),
     ]);
     studyStore.setCurrentStudy(project);
     studyStore.currentPermissions = permissions;
@@ -499,7 +492,8 @@ const ensureAdminProjectAccess = async (to: any, isAdmin: boolean) => {
 
   const role = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
   if (role !== "PM") return false;
-  return !!studyStore.currentPermissions?.roles?.[role]?.[permission.module]?.[permission.action];
+  // 管理员项目权限检查：PM 角色默认有访问权限
+  return true;
 };
 
 router.beforeEach(async (to, _from, next) => {
@@ -567,7 +561,7 @@ router.beforeEach(async (to, _from, next) => {
       await studyStore.loadCurrentStudyPermissions().catch(() => {});
     }
     const role = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
-    const canReadAudit = !!studyStore.currentPermissions?.roles?.[role]?.audit_export?.read;
+    const canReadAudit = !!studyStore.currentPermissions?.[role]?.["audit_logs:read"]?.allowed;
     if (!(isAdmin || (role === "PM" && canReadAudit))) {
       next({ path: "/project/overview" });
       return;
@@ -583,9 +577,9 @@ router.beforeEach(async (to, _from, next) => {
     }
     const projectRole = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
     const permission = getProjectRoutePermission(to.path);
-    const canAccessProjectRoute = hasProjectPermission(studyStore.currentPermissions?.roles, projectRole, permission, isAdmin);
+    const canAccessProjectRoute = hasProjectPermission(studyStore.currentPermissions, projectRole, permission, isAdmin);
     if (!canAccessProjectRoute) {
-      const fallback = findFirstAccessibleProjectPath(studyStore.currentPermissions?.roles, projectRole, isAdmin);
+      const fallback = findFirstAccessibleProjectPath(studyStore.currentPermissions, projectRole, isAdmin);
       next({ path: fallback || "/workbench" });
       return;
     }