feat(perm): 项目 PM 共管接口权限与监控并细化 PM 写权限边界

- deps 新增 list_active_pm_study_ids、is_active_project_pm 与
  require_admin_or_any_project_pm 依赖，用于把 PM 项目范围带进鉴权与
  监控。get_cra_site_scope 内部延后导入 site CRUD，避免循环依赖。
- system_permissions API 改用 PM/ADMIN 双角色入口，permissions/monitoring
  系统级权限新增 PM 配额，并细化访问日志、告警、监控指标的可见范围。
- members API 调整：项目 PM 仅可管理低于 PM 的项目角色，禁止互相
  改写或授予 PM。
- api_permissions API 增加 GET /api-permissions/me，返回当前用户在该
  项目的有效权限矩阵；保存权限矩阵时校验 PM 行为不被篡改。
- core/api_permissions：新增立项配置接口键、PM 默认拥有的监控/权限
  系统级条目，并在权限元信息中标注 PM 共享角色。
- core/project_permissions：role_has_api_permission 命中默认角色矩阵；
  replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。
- studies setup-config 各端点改用接口级权限装饰器，与新的 setup_config
  权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。
- 测试：新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和
  成员管理边界；conftest 兼容 SA_UUID 列；权限相关用例同步移除已失效
  的 module_permission 链路。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/api/v1/studies.py

@@ -10,6 +10,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.deps import (
     get_current_user,
     get_db_session,
+    require_api_permission,
     require_roles,
     require_study_member,
     require_study_not_locked,
@@ -933,7 +934,7 @@ async def unlock_study(
 @router.get(
     "/{study_id}/setup-config",
     response_model=StudySetupConfigRead,
-    dependencies=[Depends(require_study_member())],
+    dependencies=[Depends(require_api_permission("setup_config:read"))],
 )
 async def get_study_setup_config(
     study_id: uuid.UUID,
@@ -990,7 +991,7 @@ async def get_study_setup_config(
 @router.put(
     "/{study_id}/setup-config",
     response_model=StudySetupConfigRead,
-    dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("setup_config:update")), Depends(require_study_not_locked())],
 )
 async def upsert_study_setup_config(
     study_id: uuid.UUID,
@@ -1068,7 +1069,7 @@ async def upsert_study_setup_config(
 @router.post(
     "/{study_id}/setup-config/publish",
     response_model=StudySetupConfigRead,
-    dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("setup_config:publish")), Depends(require_study_not_locked())],
 )
 async def publish_study_setup_config(
     study_id: uuid.UUID,
@@ -1187,7 +1188,7 @@ async def publish_study_setup_config(
 @router.get(
     "/{study_id}/setup-config/versions",
     response_model=list[StudySetupConfigVersionRead],
-    dependencies=[Depends(require_study_member())],
+    dependencies=[Depends(require_api_permission("setup_config:read"))],
 )
 async def list_study_setup_config_versions(
     study_id: uuid.UUID,
@@ -1221,7 +1222,7 @@ async def list_study_setup_config_versions(
 @router.post(
     "/{study_id}/setup-config/rollback",
     response_model=StudySetupConfigRead,
-    dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("setup_config:rollback")), Depends(require_study_not_locked())],
 )
 async def rollback_study_setup_config(
     study_id: uuid.UUID,
@@ -1279,7 +1280,7 @@ async def rollback_study_setup_config(
 @router.post(
     "/{study_id}/setup-config/draft/checkout-branch",
     response_model=StudySetupConfigRead,
-    dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("setup_config:update")), Depends(require_study_not_locked())],
 )
 async def checkout_study_setup_config_branch_draft(
     study_id: uuid.UUID,
@@ -1338,7 +1339,7 @@ async def checkout_study_setup_config_branch_draft(
 @router.post(
     "/{study_id}/setup-config/draft/clear",
     response_model=StudySetupConfigRead,
-    dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("setup_config:update")), Depends(require_study_not_locked())],
 )
 async def clear_study_setup_config_draft(
     study_id: uuid.UUID,
@@ -1390,7 +1391,7 @@ async def clear_study_setup_config_draft(
 @router.post(
     "/{study_id}/setup-config/draft/refill",
     response_model=StudySetupConfigRead,
-    dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("setup_config:update")), Depends(require_study_not_locked())],
 )
 async def refill_study_setup_config_draft(
     study_id: uuid.UUID,
@@ -1444,7 +1445,7 @@ async def refill_study_setup_config_draft(
 @router.post(
     "/{study_id}/setup-config/merge-main",
     response_model=StudySetupConfigRead,
-    dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("setup_config:publish")), Depends(require_study_not_locked())],
 )
 async def merge_study_setup_config_to_main(
     study_id: uuid.UUID,
@@ -1539,7 +1540,7 @@ async def merge_study_setup_config_to_main(
 @router.delete(
     "/{study_id}/setup-config/versions/{target_version}",
     status_code=status.HTTP_204_NO_CONTENT,
-    dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_api_permission("setup_config:delete_version")), Depends(require_study_not_locked())],
 )
 async def delete_study_setup_config_version(
     study_id: uuid.UUID,