完善后台管理与测试支撑

1、为后台用户列表增加关键词和状态筛选，后端同步支持过滤与总数统计。

2、创建用户时要求填写初始密码，并补充前端校验和自动填充隔离。

3、优化项目管理列表角色展示、项目详情抽屉脏数据保护和审计详情抽屉关闭体验。

4、清理旧费用附件关联、统一测试模型注册，并更新迁移端点和注册筛选测试。

backend/tests/test_migrated_endpoints_batch3.py

@@ -101,41 +101,16 @@ async def test_startup_auth_read_with_permission(db_session: AsyncSession):
 
 
 # ============================================================================
-# 项目权限管理 (project_permissions) - 2个端点
+# 项目权限管理已迁移为系统级权限
 # ============================================================================
 
-@pytest.mark.asyncio
-async def test_project_permissions_get_with_permission(db_session: AsyncSession):
-    """验证有权限的PM可以查询项目权限矩阵"""
-    study_id = uuid.uuid4()
-    perm = ApiEndpointPermission(
-        study_id=study_id,
-        role="PM",
-        endpoint_key="permissions:read",
-        allowed=True,
-    )
-    db_session.add(perm)
-    await db_session.commit()
+def test_project_permissions_are_not_project_matrix_permissions():
+    """项目权限配置由 system:permissions:project_config 控制，不再进入项目矩阵。"""
+    from app.core.api_permissions import API_ENDPOINT_PERMISSIONS, SYSTEM_PERMISSIONS
 
-    allowed = await role_has_api_permission(db_session, study_id, "PM", "permissions:read")
-    assert allowed is True
-
-
-@pytest.mark.asyncio
-async def test_project_permissions_update_with_permission(db_session: AsyncSession):
-    """验证有权限的PM可以更新项目权限矩阵"""
-    study_id = uuid.uuid4()
-    perm = ApiEndpointPermission(
-        study_id=study_id,
-        role="PM",
-        endpoint_key="permissions:update",
-        allowed=True,
-    )
-    db_session.add(perm)
-    await db_session.commit()
-
-    allowed = await role_has_api_permission(db_session, study_id, "PM", "permissions:update")
-    assert allowed is True
+    assert "permissions:read" not in API_ENDPOINT_PERMISSIONS
+    assert "permissions:update" not in API_ENDPOINT_PERMISSIONS
+    assert "system:permissions:project_config" in SYSTEM_PERMISSIONS
 
 
 # ============================================================================
@@ -506,17 +481,9 @@ async def test_startup_permission_denied_for_cra(db_session: AsyncSession):
 
 
 @pytest.mark.asyncio
-async def test_project_permissions_denied_for_cra(db_session: AsyncSession):
-    """验证CRA无法修改项目权限"""
+async def test_removed_project_permissions_are_denied_for_project_roles(db_session: AsyncSession):
+    """项目角色不能再通过 permissions:update 这种残留 key 获得权限管理能力。"""
     study_id = uuid.uuid4()
-    perm = ApiEndpointPermission(
-        study_id=study_id,
-        role="CRA",
-        endpoint_key="permissions:update",
-        allowed=False,
-    )
-    db_session.add(perm)
-    await db_session.commit()
 
     allowed = await role_has_api_permission(db_session, study_id, "CRA", "permissions:update")
     assert allowed is False