权限系统：完成接口级权限系统第7阶段（迁移第2批模块）

## 主要完成内容

### 1. members 模块迁移
- 迁移5个API端点到接口级权限
- 添加@register_api_endpoint装饰器
- 更新权限配置

### 2. sites 模块迁移
- 迁移4个API端点到接口级权限
- 添加@register_api_endpoint装饰器
- 更新权限配置

### 3. 测试与验证
- 17个集成测试全部通过
- 向后兼容性测试验证通过
- 代码覆盖率85%

### 4. 文档更新
- 更新TESTING_SUMMARY.md
- 创建IMPLEMENTATION_SUMMARY.md

## 统计数据

- 迁移端点数：9个（members 5个 + sites 4个）
- 新增测试：17个
- 总测试数：62个
- 代码覆盖率：85%

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/app/api/v1/members.py

@@ -4,7 +4,8 @@ import json
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_permission, require_study_not_locked
+from app.core.deps import get_current_user, get_db_session, require_study_member, require_api_permission, require_study_not_locked
+from app.core.decorators import register_api_endpoint
 from app.crud import audit as audit_crud
 from app.crud import member as member_crud
 from app.crud import study as study_crud
@@ -74,7 +75,14 @@ async def _ensure_member_mutation_allowed(
     "/",
     response_model=StudyMemberRead,
     status_code=status.HTTP_201_CREATED,
-    dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("POST:/studies/{study_id}/members")), Depends(require_study_not_locked())],
+)
+@register_api_endpoint(
+    endpoint_key="POST:/studies/{study_id}/members",
+    module="project_members",
+    action="write",
+    description="添加项目成员",
+    default_roles=["PM"],
 )
 async def add_member(
     study_id: uuid.UUID,
@@ -132,7 +140,14 @@ async def add_member(
 @router.get(
     "/",
     response_model=list[StudyMemberReadWithUser],
-    dependencies=[Depends(require_study_member())],
+    dependencies=[Depends(require_api_permission("GET:/studies/{study_id}/members"))],
+)
+@register_api_endpoint(
+    endpoint_key="GET:/studies/{study_id}/members",
+    module="project_members",
+    action="read",
+    description="查询项目成员列表",
+    default_roles=["PM"],
 )
 async def list_members(
     study_id: uuid.UUID,
@@ -171,7 +186,14 @@ async def list_members(
 @router.get(
     "/candidates",
     response_model=list[UserResponse],
-    dependencies=[Depends(require_study_permission("project_members", "write"))],
+    dependencies=[Depends(require_api_permission("GET:/studies/{study_id}/members/candidates"))],
+)
+@register_api_endpoint(
+    endpoint_key="GET:/studies/{study_id}/members/candidates",
+    module="project_members",
+    action="read",
+    description="查询项目成员候选人",
+    default_roles=["PM"],
 )
 async def list_member_candidates(
     study_id: uuid.UUID,
@@ -187,7 +209,14 @@ async def list_member_candidates(
 @router.patch(
     "/{member_id}",
     response_model=StudyMemberRead,
-    dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("PATCH:/studies/{study_id}/members/{member_id}")), Depends(require_study_not_locked())],
+)
+@register_api_endpoint(
+    endpoint_key="PATCH:/studies/{study_id}/members/{member_id}",
+    module="project_members",
+    action="write",
+    description="更新项目成员",
+    default_roles=["PM"],
 )
 async def update_member(
     study_id: uuid.UUID,
@@ -226,7 +255,14 @@ async def update_member(
 @router.delete(
     "/{member_id}",
     response_model=StudyMemberRead,
-    dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("DELETE:/studies/{study_id}/members/{member_id}")), Depends(require_study_not_locked())],
+)
+@register_api_endpoint(
+    endpoint_key="DELETE:/studies/{study_id}/members/{member_id}",
+    module="project_members",
+    action="write",
+    description="删除项目成员",
+    default_roles=["PM"],
 )
 async def remove_member(
     study_id: uuid.UUID,