权限系统迁移完成：接口级权限 + 前置权限检查

## 核心改进
- 完全迁移到接口级权限（68个API端点）
- 实现前置权限检查机制，解决跨模块数据访问权限问题
- 添加权限管理API端点，支持前置权限查询

## 关键变更
1. 权限配置系统
   - 添加OPERATION_PREREQUISITES映射表
   - 所有操作配置前置权限依赖

2. 权限检查函数
   - role_has_api_permission()支持前置权限检查
   - get_missing_prerequisites()获取缺失权限列表

3. 权限管理API
   - GET /api-permissions/operations - 获取所有操作及前置权限
   - GET /api-permissions/operations/prerequisites - 获取前置权限依赖
   - GET /api-permissions/{endpoint_key}/prerequisites - 检查缺失权限

4. API端点迁移
   - 第1批：subjects, visits, aes, monitoring_visit_issues (23个)
   - 第2批：members, sites, project_milestones (11个)
   - 第3批：finance_contracts, fees_contracts, drug_shipments (15个)
   - 第4批：startup endpoints (19个)

## 测试验证
- 单元测试：24个测试全部通过
- 集成测试：22个迁移端点测试通过
- 前置权限测试：12个测试全部通过
- 总计：46个测试全部通过

## 向后兼容性
- 模块级权限表保留用于历史数据
- 接口级权限未配置时自动回退到模块级权限
- 现有权限配置继续有效

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/app/core/deps.py

@@ -10,7 +10,7 @@ from app.core.security import decode_token, oauth2_scheme
 from app.crud import user as user_crud
 from app.crud import member as member_crud
 from app.crud import site as site_crud
-from app.core.project_permissions import role_has_project_permission, role_has_api_permission
+from app.core.project_permissions import role_has_project_permission, role_has_api_permission, get_missing_prerequisites
 from app.db.session import SessionLocal
 from app.schemas.user import TokenPayload
 
@@ -147,12 +147,13 @@ def require_study_permission(module: str, action: str, *, allow_system_admin: bo
     return dependency
 
 
-def require_api_permission(endpoint_key: str, *, allow_system_admin: bool = True):
-    """基于接口的权限检查
+def require_api_permission(endpoint_key: str, *, allow_system_admin: bool = True, check_prerequisites: bool = True):
+    """基于接口的权限检查（包含前置权限检查）
 
     参数:
-        endpoint_key: 接口标识，格式为 "METHOD:/path"，如 "POST:/subjects"
+        endpoint_key: 接口标识，格式为 "subjects:create"
         allow_system_admin: 是否允许系统管理员绕过权限检查
+        check_prerequisites: 是否检查前置权限
     """
     async def dependency(
         study_id: uuid.UUID,
@@ -169,13 +170,26 @@ def require_api_permission(endpoint_key: str, *, allow_system_admin: bool = True
                 message="不是该项目成员",
                 status_code=status.HTTP_403_FORBIDDEN,
             )
-        allowed = await role_has_api_permission(db, study_id, membership.role_in_study, endpoint_key)
+        allowed = await role_has_api_permission(
+            db, study_id, membership.role_in_study, endpoint_key, check_prerequisites=check_prerequisites
+        )
         if not allowed:
-            raise AppException(
-                code="FORBIDDEN",
-                message="接口权限不足",
-                status_code=status.HTTP_403_FORBIDDEN,
+            # 获取缺失的前置权限，用于错误提示
+            missing_prereqs = await get_missing_prerequisites(
+                db, study_id, membership.role_in_study, endpoint_key
             )
+            if missing_prereqs:
+                raise AppException(
+                    code="FORBIDDEN",
+                    message=f"缺失前置权限: {', '.join(missing_prereqs)}",
+                    status_code=status.HTTP_403_FORBIDDEN,
+                )
+            else:
+                raise AppException(
+                    code="FORBIDDEN",
+                    message="接口权限不足",
+                    status_code=status.HTTP_403_FORBIDDEN,
+                )
         return current_user
 
     return dependency