完善后台管理与测试支撑

1、为后台用户列表增加关键词和状态筛选，后端同步支持过滤与总数统计。

2、创建用户时要求填写初始密码，并补充前端校验和自动填充隔离。

3、优化项目管理列表角色展示、项目详情抽屉脏数据保护和审计详情抽屉关闭体验。

4、清理旧费用附件关联、统一测试模型注册，并更新迁移端点和注册筛选测试。

backend/tests/test_registration.py

@@ -190,6 +190,64 @@ async def test_admin_can_approve_user(client_and_db):
         assert refreshed.approved_by is not None
 
 
+@pytest.mark.asyncio
+async def test_admin_users_list_filters_by_keyword_and_status(client_and_db):
+    client, SessionLocal = client_and_db
+    async with SessionLocal() as session:
+        session.add_all(
+            [
+                User(
+                    email="active-filter@test.com",
+                    password_hash=hash_password("Password123"),
+                    full_name="Active Filter",
+                    clinical_department="Oncology",
+                    status=UserStatus.ACTIVE,
+                ),
+                User(
+                    email="pending-filter@test.com",
+                    password_hash=hash_password("Password123"),
+                    full_name="Pending Filter",
+                    clinical_department="Cardiology",
+                    status=UserStatus.PENDING,
+                ),
+                User(
+                    email="disabled-filter@test.com",
+                    password_hash=hash_password("Password123"),
+                    full_name="Disabled Filter",
+                    clinical_department="Oncology",
+                    status=UserStatus.DISABLED,
+                ),
+            ]
+        )
+        await session.commit()
+
+    admin_login = await encrypted_login(client, "admin@test.com", "admin123")
+    token = admin_login.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+
+    active_resp = await client.get("/api/v1/users/?status=ACTIVE", headers=headers)
+    assert active_resp.status_code == 200
+    active_items = active_resp.json()["items"]
+    assert all(item["status"] == "ACTIVE" for item in active_items)
+    assert {item["email"] for item in active_items} >= {"admin@test.com", "active-filter@test.com"}
+    assert "pending-filter@test.com" not in {item["email"] for item in active_items}
+
+    keyword_resp = await client.get("/api/v1/users/?keyword=Oncology", headers=headers)
+    assert keyword_resp.status_code == 200
+    keyword_data = keyword_resp.json()
+    assert keyword_data["total"] == 2
+    assert {item["email"] for item in keyword_data["items"]} == {
+        "active-filter@test.com",
+        "disabled-filter@test.com",
+    }
+
+    combined_resp = await client.get("/api/v1/users/?keyword=Filter&status=PENDING", headers=headers)
+    assert combined_resp.status_code == 200
+    combined_data = combined_resp.json()
+    assert combined_data["total"] == 1
+    assert combined_data["items"][0]["email"] == "pending-filter@test.com"
+
+
 def test_register_request_does_not_expose_role_input():
     assert "role" not in UserRegisterRequest.model_fields