feat(perm): 项目 PM 共管接口权限与监控并细化 PM 写权限边界

- deps 新增 list_active_pm_study_ids、is_active_project_pm 与
  require_admin_or_any_project_pm 依赖，用于把 PM 项目范围带进鉴权与
  监控。get_cra_site_scope 内部延后导入 site CRUD，避免循环依赖。
- system_permissions API 改用 PM/ADMIN 双角色入口，permissions/monitoring
  系统级权限新增 PM 配额，并细化访问日志、告警、监控指标的可见范围。
- members API 调整：项目 PM 仅可管理低于 PM 的项目角色，禁止互相
  改写或授予 PM。
- api_permissions API 增加 GET /api-permissions/me，返回当前用户在该
  项目的有效权限矩阵；保存权限矩阵时校验 PM 行为不被篡改。
- core/api_permissions：新增立项配置接口键、PM 默认拥有的监控/权限
  系统级条目，并在权限元信息中标注 PM 共享角色。
- core/project_permissions：role_has_api_permission 命中默认角色矩阵；
  replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。
- studies setup-config 各端点改用接口级权限装饰器，与新的 setup_config
  权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。
- 测试：新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和
  成员管理边界；conftest 兼容 SA_UUID 列；权限相关用例同步移除已失效
  的 module_permission 链路。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/core/deps.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 from typing import Annotated, AsyncGenerator, Callable, Iterable
 import time
 import uuid
@@ -10,10 +12,11 @@ from app.core.exceptions import AppException
 from app.core.security import decode_token, oauth2_scheme
 from app.crud import user as user_crud
 from app.crud import member as member_crud
-from app.crud import site as site_crud
 from app.core.project_permissions import role_has_api_permission, get_missing_prerequisites
 from app.db.session import SessionLocal
+from app.models.study_member import StudyMember
 from app.schemas.user import TokenPayload
+from sqlalchemy import select
 
 
 async def get_db_session() -> AsyncGenerator[AsyncSession, None]:
@@ -65,12 +68,56 @@ def require_roles(roles: Iterable[str]) -> Callable:
     return dependency
 
 
+def _role_value(user) -> str:
+    return user.role.value if hasattr(user.role, "value") else str(user.role)
+
+
+async def list_active_pm_study_ids(db: AsyncSession, user_id: uuid.UUID) -> set[uuid.UUID]:
+    result = await db.execute(
+        select(StudyMember.study_id).where(
+            StudyMember.user_id == user_id,
+            StudyMember.is_active.is_(True),
+            StudyMember.role_in_study == "PM",
+        )
+    )
+    return set(result.scalars().all())
+
+
+async def is_active_project_pm(db: AsyncSession, user_id: uuid.UUID, study_id: uuid.UUID) -> bool:
+    result = await db.execute(
+        select(StudyMember.id).where(
+            StudyMember.study_id == study_id,
+            StudyMember.user_id == user_id,
+            StudyMember.is_active.is_(True),
+            StudyMember.role_in_study == "PM",
+        )
+    )
+    return result.scalar_one_or_none() is not None
+
+
+def require_admin_or_any_project_pm() -> Callable:
+    async def dependency(
+        current_user=Depends(get_current_user),
+        db: AsyncSession = Depends(get_db_session),
+    ):
+        if _role_value(current_user) == "ADMIN":
+            return current_user
+        if await list_active_pm_study_ids(db, current_user.id):
+            return current_user
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="权限不足",
+        )
+
+    return dependency
+
+
 async def get_study_member(
     study_id: uuid.UUID,
     current_user=Depends(get_current_user),
     db: AsyncSession = Depends(get_db_session),
 ):
-    role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
+    role_value = _role_value(current_user)
     if role_value == "ADMIN":
         return None
     return await member_crud.get_member(db, study_id, current_user.id)
@@ -82,7 +129,7 @@ def require_study_member():
         current_user=Depends(get_current_user),
         db: AsyncSession = Depends(get_db_session),
     ):
-        role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
+        role_value = _role_value(current_user)
         if role_value == "ADMIN":
             return current_user
         membership = await member_crud.get_member(db, study_id, current_user.id)
@@ -105,7 +152,7 @@ def require_study_roles(roles: Iterable[str], *, allow_system_admin: bool = True
         current_user=Depends(get_current_user),
         db: AsyncSession = Depends(get_db_session),
     ):
-        role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
+        role_value = _role_value(current_user)
         if allow_system_admin and role_value == "ADMIN":
             return current_user
         membership = await member_crud.get_member(db, study_id, current_user.id)
@@ -136,7 +183,7 @@ def require_api_permission(endpoint_key: str, *, allow_system_admin: bool = True
         db: AsyncSession = Depends(get_db_session),
     ):
         from app.core.permission_monitor import get_permission_monitor
-        role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
+        role_value = _role_value(current_user)
         if allow_system_admin and role_value == "ADMIN":
             _enqueue_permission_log(
                 study_id, current_user.id, endpoint_key, "ADMIN", True, 0.0, request
@@ -226,6 +273,8 @@ async def get_cra_site_scope(
     study_id: uuid.UUID,
     current_user,
 ) -> tuple[set[uuid.UUID], set[str]] | None:
+    from app.crud import site as site_crud
+
     role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
     if role_value == "ADMIN":
         return None