完全移除模块级权限系统，迁移至接口级权限

后端：
- 删除 StudyRolePermission 模型和 project_permissions API 文件
- 重写 project_permissions.py core，移除所有模块级权限函数
- 重写 permission_cache.py，移除模块级权限缓存逻辑
- 新增权限模板功能（PermissionTemplate 模型、API、服务层）
- 新增 permission_templates 数据库迁移
- 迁移 8 个模块（attachments、audit_logs、dashboard、faqs、
  faq_categories、fees_attachments、knowledge_notes、
  material_equipments、overview、subject_histories、subject_pds）
  至接口级权限检查
- 删除所有模块级权限相关测试文件，新增权限模板测试

前端：
- 删除 ProjectPermissions.vue 和 ProjectPermissionsModule.vue
- 重写 projectRoutePermissions.ts，改为基于接口级权限格式
- 更新 store/study.ts、router/index.ts、AuditLogs.vue、Projects.vue
  中的权限 API 调用，从 fetchProjectRolePermissions 改为
  fetchApiEndpointPermissions
- 清理 types/api.ts 中的旧模块级权限类型定义
- 新增 PermissionTemplateSelector.vue 组件
- 更新权限管理页面，移除模块级权限 tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/views/admin/Projects.vue

@@ -76,8 +76,8 @@ import { useRouter } from "vue-router";
 import { ElMessage, ElMessageBox } from "element-plus";
 import { User, OfficeBuilding, ArrowRight, Delete, Lock, Key, Document } from "@element-plus/icons-vue";
 import { fetchStudies, deleteStudy, lockStudy } from "../../api/studies";
-import { fetchProjectRolePermissions } from "../../api/projectPermissions";
-import type { ProjectRolePermissionsResponse, Study } from "../../types/api";
+import { fetchApiEndpointPermissions } from "../../api/projectPermissions";
+import type { ApiEndpointPermissionsResponse, Study } from "../../types/api";
 import ProjectForm from "./ProjectForm.vue";
 import { useStudyStore } from "../../store/study";
 import { useAuthStore } from "../../store/auth";
@@ -92,7 +92,7 @@ const router = useRouter();
 const studyStore = useStudyStore();
 const auth = useAuthStore();
 const isAdmin = computed(() => isSystemAdmin(auth.user));
-const permissionsByProject = ref<Record<string, ProjectRolePermissionsResponse>>({});
+const permissionsByProject = ref<Record<string, ApiEndpointPermissionsResponse>>({});
 
 const loadProjects = async () => {
   loading.value = true;
@@ -104,7 +104,7 @@ const loadProjects = async () => {
       const entries = await Promise.all(
         items.map(async (item: Study) => {
           try {
-            const { data: permissions } = await fetchProjectRolePermissions(item.id);
+            const { data: permissions } = await fetchApiEndpointPermissions(item.id);
             return [item.id, permissions] as const;
           } catch {
             return [item.id, null] as const;
@@ -126,10 +126,18 @@ const openCreate = () => {
   formVisible.value = true;
 };
 
+const MODULE_TO_OPERATION: Record<string, Record<string, string>> = {
+  project_members: { read: "project_members:read", write: "project_members:update" },
+  sites: { read: "sites:read", write: "sites:update" },
+  audit_export: { read: "audit_logs:read", write: "audit_logs:read" },
+};
+
 const canProject = (row: Study, module: string, action: "read" | "write") => {
   if (isAdmin.value) return true;
   const role = row.role_in_study || "";
-  return !!permissionsByProject.value[row.id]?.roles?.[role as keyof ProjectRolePermissionsResponse["roles"]]?.[module]?.[action];
+  const operationKey = MODULE_TO_OPERATION[module]?.[action];
+  if (!operationKey) return false;
+  return !!permissionsByProject.value[row.id]?.[role]?.[operationKey]?.allowed;
 };
 
 const goMembers = (row: Study) => {