移除用户系统级角色，权限完全迁移至项目级管理

- 用户注册/创建不再需要选择角色，账号管理只管资料和状态
- 移除前后端所有系统级 role 字段的暴露，改用 is_admin 标识管理员
- PM（项目负责人）角色自动拥有全部项目权限且不可修改
- 系统管理员在项目中的成员身份不可被删除
- 管理界面全面美化

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/app/core/project_permissions.py

@@ -48,7 +48,7 @@ async def role_has_api_permission(
     check_prerequisites: bool = True,
 ) -> bool:
     """检查角色是否有权访问特定接口"""
-    if role == "ADMIN":
+    if role == "ADMIN" or role == "PM":
         return True
 
     permissions = await _get_project_permission_overrides(db, study_id)
@@ -78,7 +78,7 @@ async def get_missing_prerequisites(
     endpoint_key: str,
 ) -> list[str]:
     """获取缺失的前置权限列表"""
-    if role == "ADMIN":
+    if role == "ADMIN" or role == "PM":
         return []
 
     missing = []
@@ -111,8 +111,11 @@ async def get_api_endpoint_permissions(
     for role in roles:
         matrix[role] = {}
         for endpoint_key, config in API_ENDPOINT_PERMISSIONS.items():
-            default_allowed = role in config.get("default_roles", [])
-            matrix[role][endpoint_key] = {"allowed": default_allowed}
+            if role == "PM":
+                matrix[role][endpoint_key] = {"allowed": True}
+            else:
+                default_allowed = role in config.get("default_roles", [])
+                matrix[role][endpoint_key] = {"allowed": default_allowed}
 
     for role, endpoints in overrides.items():
         if role not in matrix:
@@ -136,7 +139,7 @@ async def replace_api_endpoint_permissions(
     )
 
     for role, endpoints in payload.items():
-        if role == "ADMIN":
+        if role in ("ADMIN", "PM"):
             continue
         for endpoint_key, allowed in endpoints.items():
             if endpoint_key not in API_ENDPOINT_PERMISSIONS: