权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。

backend/app/core/deps.py

@@ -10,6 +10,7 @@ from app.core.security import decode_token, oauth2_scheme
 from app.crud import user as user_crud
 from app.crud import member as member_crud
 from app.crud import site as site_crud
+from app.core.project_permissions import role_has_project_permission
 from app.db.session import SessionLocal
 from app.schemas.user import TokenPayload
 
@@ -118,6 +119,34 @@ def require_study_roles(roles: Iterable[str], *, allow_system_admin: bool = True
     return dependency
 
 
+def require_study_permission(module: str, action: str, *, allow_system_admin: bool = True):
+    async def dependency(
+        study_id: uuid.UUID,
+        current_user=Depends(get_current_user),
+        db: AsyncSession = Depends(get_db_session),
+    ):
+        role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
+        if allow_system_admin and role_value == "ADMIN":
+            return current_user
+        membership = await member_crud.get_member(db, study_id, current_user.id)
+        if not membership or not membership.is_active:
+            raise AppException(
+                code="FORBIDDEN",
+                message="不是该项目成员",
+                status_code=status.HTTP_403_FORBIDDEN,
+            )
+        allowed = await role_has_project_permission(db, study_id, membership.role_in_study, module, action)
+        if not allowed:
+            raise AppException(
+                code="FORBIDDEN",
+                message="项目权限不足",
+                status_code=status.HTTP_403_FORBIDDEN,
+            )
+        return current_user
+
+    return dependency
+
+
 async def get_cra_site_scope(
     db: AsyncSession,
     study_id: uuid.UUID,