移除用户系统级角色，权限完全迁移至项目级管理

- 用户注册/创建不再需要选择角色，账号管理只管资料和状态
- 移除前后端所有系统级 role 字段的暴露，改用 is_admin 标识管理员
- PM（项目负责人）角色自动拥有全部项目权限且不可修改
- 系统管理员在项目中的成员身份不可被删除
- 管理界面全面美化

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/views/admin/PermissionManagement.vue

@@ -310,13 +310,16 @@
             <!-- 右侧权限编辑区 -->
             <div class="role-editor-content">
               <template v-if="editingRole">
+                <div v-if="editingRole === 'PM'" class="role-editor-notice">
+                  <el-alert title="项目负责人拥有全部权限，不可修改" type="info" :closable="false" show-icon />
+                </div>
                 <div class="role-editor-toolbar">
                   <el-input v-model="roleEditorSearch" placeholder="搜索权限..." clearable style="width: 220px">
                     <template #prefix><el-icon><Search /></el-icon></template>
                   </el-input>
                   <div class="filter-spacer" />
-                  <el-button size="small" @click="roleEditorSelectAll(true)">全选</el-button>
-                  <el-button size="small" @click="roleEditorSelectAll(false)">全不选</el-button>
+                  <el-button size="small" :disabled="editingRole === 'PM'" @click="roleEditorSelectAll(true)">全选</el-button>
+                  <el-button size="small" :disabled="editingRole === 'PM'" @click="roleEditorSelectAll(false)">全不选</el-button>
                 </div>
                 <div class="role-editor-modules">
                   <div v-for="(ops, mod) in roleEditorGrouped" :key="mod" class="role-editor-module">
@@ -328,6 +331,7 @@
                       <div v-for="op in ops" :key="op.operation_key" class="role-editor-op-row">
                         <el-checkbox
                           :model-value="roleEditorDraft[op.operation_key] ?? false"
+                          :disabled="editingRole === 'PM'"
                           @change="(v: boolean) => roleEditorDraft[op.operation_key] = v"
                         />
                         <el-tag :type="opTagType(op)" size="small" class="op-action-tag">{{ opActionLabel(op) }}</el-tag>
@@ -337,7 +341,7 @@
                   </div>
                 </div>
                 <div class="drawer-footer">
-                  <el-button type="primary" :loading="roleEditorSaving" @click="saveRoleEditor">
+                  <el-button type="primary" :loading="roleEditorSaving" :disabled="editingRole === 'PM'" @click="saveRoleEditor">
                     保存 {{ ROLE_LABELS[editingRole] }} 权限
                   </el-button>
                 </div>
@@ -585,9 +589,9 @@ const addMemberRules: FormRules = {
 };
 
 const canEditMember = (row: { user_id: string; role_in_study: string; user?: any }) => {
-  if (auth.user?.role !== "ADMIN") return false;
+  if (!auth.user?.is_admin) return false;
   if (row.user_id === auth.user?.id) return false;
-  if (row.user?.role === "ADMIN") return false;
+  if (row.user?.is_admin) return false;
   return true;
 };