feat(perm): 项目 PM 共管接口权限与监控并细化 PM 写权限边界

- deps 新增 list_active_pm_study_ids、is_active_project_pm 与
  require_admin_or_any_project_pm 依赖，用于把 PM 项目范围带进鉴权与
  监控。get_cra_site_scope 内部延后导入 site CRUD，避免循环依赖。
- system_permissions API 改用 PM/ADMIN 双角色入口，permissions/monitoring
  系统级权限新增 PM 配额，并细化访问日志、告警、监控指标的可见范围。
- members API 调整：项目 PM 仅可管理低于 PM 的项目角色，禁止互相
  改写或授予 PM。
- api_permissions API 增加 GET /api-permissions/me，返回当前用户在该
  项目的有效权限矩阵；保存权限矩阵时校验 PM 行为不被篡改。
- core/api_permissions：新增立项配置接口键、PM 默认拥有的监控/权限
  系统级条目，并在权限元信息中标注 PM 共享角色。
- core/project_permissions：role_has_api_permission 命中默认角色矩阵；
  replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。
- studies setup-config 各端点改用接口级权限装饰器，与新的 setup_config
  权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。
- 测试：新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和
  成员管理边界；conftest 兼容 SA_UUID 列；权限相关用例同步移除已失效
  的 module_permission 链路。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/api/v1/api_permissions.py

@@ -5,16 +5,17 @@ from __future__ import annotations
 import uuid
 from typing import Annotated
 
-from fastapi import APIRouter, Depends, status
+from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_db_session, require_study_roles
+from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles
 from app.core.project_permissions import (
     get_api_endpoint_permissions,
     replace_api_endpoint_permissions,
     get_missing_prerequisites,
 )
+from app.crud import member as member_crud
 from app.models.api_endpoint_registry import ApiEndpointRegistry
 from app.models.study import Study
 from app.core.api_permissions import API_ENDPOINT_PERMISSIONS, PROJECT_PERMISSION_ROLES, OPERATION_PREREQUISITES
@@ -149,6 +150,40 @@ async def check_operation_prerequisites(
     }
 
 
+@study_router.get(
+    "/me",
+    summary="获取当前用户在项目内的有效接口权限",
+    description="返回当前用户项目角色对应的有效权限，用于前端菜单和路由判断",
+    response_model=None,
+)
+async def get_my_study_api_permissions(
+    study_id: uuid.UUID,
+    _=Depends(require_study_member()),
+    current_user=Depends(get_current_user),
+    db: Annotated[AsyncSession, Depends(get_db_session)] = None,
+):
+    """获取当前用户当前项目角色的有效权限。"""
+    role_value = current_user.role.value if hasattr(current_user.role, "value") else str(current_user.role)
+    if role_value == "ADMIN":
+        return {
+            "ADMIN": {
+                endpoint_key: {"allowed": True}
+                for endpoint_key in API_ENDPOINT_PERMISSIONS.keys()
+            }
+        }
+
+    membership = await member_crud.get_member(db, study_id, current_user.id)
+    role = membership.role_in_study if membership and membership.is_active else ""
+    permissions = await get_api_endpoint_permissions(db, study_id)
+    role_permissions = permissions.get(role, {})
+    return {
+        role: {
+            endpoint_key: role_permissions.get(endpoint_key, {"allowed": False})
+            for endpoint_key in API_ENDPOINT_PERMISSIONS.keys()
+        }
+    }
+
+
 @study_router.get(
     "",
     summary="获取项目的接口级权限矩阵",
@@ -199,6 +234,7 @@ async def update_study_api_permissions(
     study_id: uuid.UUID,
     payload: dict[str, dict[str, bool]],
     _=Depends(require_study_roles(["PM"])),
+    current_user=Depends(get_current_user),
     db: Annotated[AsyncSession, Depends(get_db_session)] = None,
 ):
     """更新项目的接口级权限矩阵
@@ -212,11 +248,17 @@ async def update_study_api_permissions(
     """
     # 验证输入
     configurable_roles = set(await _get_configurable_roles(db, study_id))
+    current_role = current_user.role.value if hasattr(current_user.role, "value") else str(current_user.role)
     for role in payload.keys():
         if role == "ADMIN":
             continue
         if role not in configurable_roles:
             raise ValueError(f"无效的角色: {role}")
+        if role == "PM" and current_role != "ADMIN":
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="仅系统管理员可修改项目负责人权限",
+            )
 
     # 替换权限配置
     await replace_api_endpoint_permissions(db, study_id, payload)