权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。

backend/app/api/v1/fees_attachments.py

@@ -8,6 +8,7 @@ from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.deps import get_current_user, get_db_session, require_study_not_locked
+from app.core.project_permissions import role_has_project_permission
 from app.core.security import decode_token
 from app.crud import audit as audit_crud
 from app.crud import contract_fee as contract_fee_crud
@@ -54,7 +55,9 @@ async def _ensure_project_access(db: AsyncSession, project_id: uuid.UUID, curren
     membership = await member_crud.get_member(db, project_id, current_user.id)
     if not membership or not membership.is_active:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
-    if write and membership.role_in_study not in {"ADMIN", "PM"}:
+    action = "write" if write else "read"
+    allowed = await role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)
+    if not allowed:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
     return membership
 
@@ -230,7 +233,7 @@ async def delete_fee_attachment(
     can_delete = (
         role_value == "ADMIN"
         or attachment.uploaded_by == current_user.id
-        or (membership and getattr(membership, "role_in_study", None) == "PM")
+        or membership is not None
     )
     if not can_delete:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")