迁移合同费用通用附件

1、删除旧费用附件 API、CRUD、模型和专用前端面板，统一改用通用附件能力。

2、调整合同费用接口为 study_id 语义，并补充合同、凭证、发票等附件类型的权限映射。

3、将合同费用新建和编辑改为抽屉流程，详情页与列表页复用同一编辑组件。

4、补充数据库迁移、附件列表、合同费用抽屉和权限场景测试，覆盖旧权限移除与新流程。

frontend/src/utils/attachmentPermissions.test.ts

@@ -3,14 +3,30 @@ import { getAttachmentPermissionKey } from "./attachmentPermissions";
 
 describe("attachment permission mapping", () => {
   it("maps attachment entity types to module attachment permissions", () => {
+    expect(getAttachmentPermissionKey("contract_fee_contract", "create")).toBe("fees_contracts:create");
+    expect(getAttachmentPermissionKey("contract_fee_contract", "read")).toBe("fees_contracts:read");
     expect(getAttachmentPermissionKey("contract_fee_contract", "delete")).toBe("fees_contracts_attachments:delete");
-    expect(getAttachmentPermissionKey("startup_feasibility", "read")).toBe("startup_initiation_attachments:read");
-    expect(getAttachmentPermissionKey("startup_ethics", "create")).toBe("startup_ethics_attachments:create");
-    expect(getAttachmentPermissionKey("startup_kickoff_ppt", "read")).toBe("startup_auth_attachments:read");
+    expect(getAttachmentPermissionKey("startup_feasibility", "create")).toBe("startup_initiation:create");
+    expect(getAttachmentPermissionKey("startup_feasibility", "read")).toBe("startup_initiation:read");
+    expect(getAttachmentPermissionKey("startup_feasibility", "delete")).toBe("startup_initiation_attachments:delete");
+    expect(getAttachmentPermissionKey("startup_ethics", "create")).toBe("startup_ethics:create");
+    expect(getAttachmentPermissionKey("startup_ethics", "read")).toBe("startup_ethics:read");
+    expect(getAttachmentPermissionKey("startup_ethics", "delete")).toBe("startup_ethics_attachments:delete");
+    expect(getAttachmentPermissionKey("startup_kickoff_ppt", "create")).toBe("startup_auth:create");
+    expect(getAttachmentPermissionKey("startup_kickoff_ppt", "read")).toBe("startup_auth:read");
     expect(getAttachmentPermissionKey("training_authorization", "delete")).toBe("startup_auth_attachments:delete");
-    expect(getAttachmentPermissionKey("drug_shipment", "read")).toBe("drug_shipments_attachments:read");
-    expect(getAttachmentPermissionKey("precaution", "create")).toBe("precautions_attachments:create");
-    expect(getAttachmentPermissionKey("faq_replies", "create")).toBe("faq_attachments:create");
+    expect(getAttachmentPermissionKey("drug_shipment", "create")).toBe("drug_shipments:create");
+    expect(getAttachmentPermissionKey("drug_shipment", "read")).toBe("drug_shipments:read");
+    expect(getAttachmentPermissionKey("drug_shipment", "delete")).toBe("drug_shipments_attachments:delete");
+    expect(getAttachmentPermissionKey("material_equipment", "create")).toBe("material_equipments:update");
+    expect(getAttachmentPermissionKey("material_equipment", "read")).toBe("material_equipments:read");
+    expect(getAttachmentPermissionKey("material_equipment", "delete")).toBe("material_equipments_attachments:delete");
+    expect(getAttachmentPermissionKey("precaution", "create")).toBe("precautions:create");
+    expect(getAttachmentPermissionKey("precaution", "read")).toBe("precautions:read");
+    expect(getAttachmentPermissionKey("precaution", "delete")).toBe("precautions_attachments:delete");
+    expect(getAttachmentPermissionKey("faq_replies", "create")).toBe("faq_reply:create");
+    expect(getAttachmentPermissionKey("faq_replies", "read")).toBe("faq:read");
+    expect(getAttachmentPermissionKey("faq_replies", "delete")).toBe("faq_attachments:delete");
   });
 
   it("does not return generic attachments permissions", () => {

frontend/src/utils/attachmentPermissions.ts

@@ -1,25 +1,81 @@
 export type AttachmentPermissionAction = "create" | "read" | "delete";
 
-const ATTACHMENT_PERMISSION_PREFIXES: Record<string, string> = {
-  contract_fee_contract: "fees_contracts_attachments",
-  contract_fee_voucher: "fees_contracts_attachments",
-  contract_fee_invoice: "fees_contracts_attachments",
-  startup_feasibility: "startup_initiation_attachments",
-  startup_ethics: "startup_ethics_attachments",
-  startup_kickoff: "startup_auth_attachments",
-  startup_kickoff_minutes: "startup_auth_attachments",
-  startup_kickoff_signin: "startup_auth_attachments",
-  startup_kickoff_ppt: "startup_auth_attachments",
-  training_authorization: "startup_auth_attachments",
-  drug_shipment: "drug_shipments_attachments",
-  precaution: "precautions_attachments",
-  faq_replies: "faq_attachments",
+const PERMISSIONS_BY_ENTITY_ACTION: Record<string, Record<AttachmentPermissionAction, string>> = {
+  contract_fee_contract: {
+    create: "fees_contracts:create",
+    read: "fees_contracts:read",
+    delete: "fees_contracts_attachments:delete",
+  },
+  contract_fee_voucher: {
+    create: "fees_contracts:create",
+    read: "fees_contracts:read",
+    delete: "fees_contracts_attachments:delete",
+  },
+  contract_fee_invoice: {
+    create: "fees_contracts:create",
+    read: "fees_contracts:read",
+    delete: "fees_contracts_attachments:delete",
+  },
+  startup_feasibility: {
+    create: "startup_initiation:create",
+    read: "startup_initiation:read",
+    delete: "startup_initiation_attachments:delete",
+  },
+  startup_ethics: {
+    create: "startup_ethics:create",
+    read: "startup_ethics:read",
+    delete: "startup_ethics_attachments:delete",
+  },
+  startup_kickoff: {
+    create: "startup_auth:create",
+    read: "startup_auth:read",
+    delete: "startup_auth_attachments:delete",
+  },
+  startup_kickoff_minutes: {
+    create: "startup_auth:create",
+    read: "startup_auth:read",
+    delete: "startup_auth_attachments:delete",
+  },
+  startup_kickoff_signin: {
+    create: "startup_auth:create",
+    read: "startup_auth:read",
+    delete: "startup_auth_attachments:delete",
+  },
+  startup_kickoff_ppt: {
+    create: "startup_auth:create",
+    read: "startup_auth:read",
+    delete: "startup_auth_attachments:delete",
+  },
+  training_authorization: {
+    create: "startup_auth:create",
+    read: "startup_auth:read",
+    delete: "startup_auth_attachments:delete",
+  },
+  drug_shipment: {
+    create: "drug_shipments:create",
+    read: "drug_shipments:read",
+    delete: "drug_shipments_attachments:delete",
+  },
+  material_equipment: {
+    create: "material_equipments:update",
+    read: "material_equipments:read",
+    delete: "material_equipments_attachments:delete",
+  },
+  precaution: {
+    create: "precautions:create",
+    read: "precautions:read",
+    delete: "precautions_attachments:delete",
+  },
+  faq_replies: {
+    create: "faq_reply:create",
+    read: "faq:read",
+    delete: "faq_attachments:delete",
+  },
 };
 
 export const getAttachmentPermissionKey = (
   entityType: string,
   action: AttachmentPermissionAction
 ): string | null => {
-  const prefix = ATTACHMENT_PERMISSION_PREFIXES[entityType];
-  return prefix ? `${prefix}:${action}` : null;
+  return PERMISSIONS_BY_ENTITY_ACTION[entityType]?.[action] || null;
 };