feat(perm): 项目 PM 共管接口权限与监控并细化 PM 写权限边界

- deps 新增 list_active_pm_study_ids、is_active_project_pm 与
  require_admin_or_any_project_pm 依赖，用于把 PM 项目范围带进鉴权与
  监控。get_cra_site_scope 内部延后导入 site CRUD，避免循环依赖。
- system_permissions API 改用 PM/ADMIN 双角色入口，permissions/monitoring
  系统级权限新增 PM 配额，并细化访问日志、告警、监控指标的可见范围。
- members API 调整：项目 PM 仅可管理低于 PM 的项目角色，禁止互相
  改写或授予 PM。
- api_permissions API 增加 GET /api-permissions/me，返回当前用户在该
  项目的有效权限矩阵；保存权限矩阵时校验 PM 行为不被篡改。
- core/api_permissions：新增立项配置接口键、PM 默认拥有的监控/权限
  系统级条目，并在权限元信息中标注 PM 共享角色。
- core/project_permissions：role_has_api_permission 命中默认角色矩阵；
  replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。
- studies setup-config 各端点改用接口级权限装饰器，与新的 setup_config
  权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。
- 测试：新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和
  成员管理边界；conftest 兼容 SA_UUID 列；权限相关用例同步移除已失效
  的 module_permission 链路。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/core/api_permissions.py

@@ -671,6 +671,37 @@ API_ENDPOINT_PERMISSIONS = {
         "description": "搜索参与者历史",
         "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
     },
+    # 立项配置管理
+    "setup_config:read": {
+        "module": "setup_config",
+        "action": "read",
+        "description": "查询立项配置",
+        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
+    },
+    "setup_config:update": {
+        "module": "setup_config",
+        "action": "write",
+        "description": "保存立项配置草稿",
+        "default_roles": ["PM"],
+    },
+    "setup_config:publish": {
+        "module": "setup_config",
+        "action": "write",
+        "description": "发布立项配置",
+        "default_roles": ["PM"],
+    },
+    "setup_config:rollback": {
+        "module": "setup_config",
+        "action": "write",
+        "description": "回滚立项配置版本",
+        "default_roles": ["PM"],
+    },
+    "setup_config:delete_version": {
+        "module": "setup_config",
+        "action": "write",
+        "description": "删除立项配置版本",
+        "default_roles": ["PM"],
+    },
     # 项目里程碑管理
     "project_milestones:read": {
         "module": "project_milestones",
@@ -1125,6 +1156,17 @@ OPERATION_TO_ENDPOINTS: dict[str, dict[str, list[str]]] = {
             "project_milestones:update",
         ],
     },
+    "setup_config": {
+        "read": [
+            "setup_config:read",
+        ],
+        "write": [
+            "setup_config:update",
+            "setup_config:publish",
+            "setup_config:rollback",
+            "setup_config:delete_version",
+        ],
+    },
 }
 
 # 项目级权限角色列表
@@ -1179,7 +1221,8 @@ OPERATION_PREREQUISITES: dict[str, list[str]] = {
 }
 
 # 系统级权限定义
-# 描述管理后台各模块操作，当前全部由 ADMIN 角色持有
+# 描述管理后台各模块操作的权限归属
+# PM 角色的系统级权限限定在其所负责的项目范围内
 SYSTEM_PERMISSIONS: dict[str, dict] = {
     # 账号管理
     "system:users:list": {
@@ -1256,11 +1299,17 @@ SYSTEM_PERMISSIONS: dict[str, dict] = {
         "roles": ["ADMIN"],
     },
     # 权限管理
+    "system:permissions:read": {
+        "module": "system_permissions",
+        "action": "read",
+        "description": "查看系统级权限定义",
+        "roles": ["ADMIN", "PM"],
+    },
     "system:permissions:project_config": {
         "module": "system_permissions",
         "action": "update",
         "description": "配置项目接口权限",
-        "roles": ["ADMIN"],
+        "roles": ["ADMIN", "PM"],
     },
     "system:permissions:templates": {
         "module": "system_permissions",
@@ -1268,6 +1317,61 @@ SYSTEM_PERMISSIONS: dict[str, dict] = {
         "description": "管理权限模板",
         "roles": ["ADMIN"],
     },
+    # 权限监控
+    "system:monitoring:metrics": {
+        "module": "system_monitoring",
+        "action": "read",
+        "description": "查看权限监控指标",
+        "roles": ["ADMIN", "PM"],
+    },
+    "system:monitoring:cache_stats": {
+        "module": "system_monitoring",
+        "action": "read",
+        "description": "查看缓存统计",
+        "roles": ["ADMIN", "PM"],
+    },
+    "system:monitoring:alerts": {
+        "module": "system_monitoring",
+        "action": "read",
+        "description": "查看权限告警",
+        "roles": ["ADMIN", "PM"],
+    },
+    "system:monitoring:health": {
+        "module": "system_monitoring",
+        "action": "read",
+        "description": "查看权限系统健康状态",
+        "roles": ["ADMIN", "PM"],
+    },
+    "system:monitoring:access_logs": {
+        "module": "system_monitoring",
+        "action": "read",
+        "description": "查看权限访问日志",
+        "roles": ["ADMIN", "PM"],
+    },
+    "system:monitoring:trends": {
+        "module": "system_monitoring",
+        "action": "read",
+        "description": "查看权限趋势数据",
+        "roles": ["ADMIN", "PM"],
+    },
+    "system:monitoring:reset_metrics": {
+        "module": "system_monitoring",
+        "action": "update",
+        "description": "重置监控指标",
+        "roles": ["ADMIN", "PM"],
+    },
+    "system:monitoring:clear_alerts": {
+        "module": "system_monitoring",
+        "action": "update",
+        "description": "清除告警",
+        "roles": ["ADMIN", "PM"],
+    },
+    "system:monitoring:security_logs": {
+        "module": "system_monitoring",
+        "action": "read",
+        "description": "查看安全访问日志",
+        "roles": ["ADMIN"],
+    },
     # 审计日志
     "system:audit_logs:read": {
         "module": "system_audit",
@@ -1288,5 +1392,6 @@ SYSTEM_MODULE_LABELS: dict[str, str] = {
     "system_users": "账号管理",
     "system_projects": "项目管理",
     "system_permissions": "权限管理",
+    "system_monitoring": "权限监控",
     "system_audit": "审计日志",
 }