权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。

frontend/src/components/attachments/AttachmentList.vue

@@ -67,7 +67,8 @@ import AttachmentUploader from "./AttachmentUploader.vue";
 import { formatFileSize } from "./attachmentUtils";
 import { useAuthStore } from "../../store/auth";
 import { useStudyStore } from "../../store/study";
-import { getProjectRole, isSystemAdmin } from "../../utils/roles";
+import { isSystemAdmin } from "../../utils/roles";
+import { usePermission } from "../../utils/permission";
 import { listMembers } from "../../api/members";
 import { displayDateTime, displayUser, getMemberDisplayName, getUserDisplayName } from "../../utils/display";
 import { TEXT } from "../../locales";
@@ -84,6 +85,7 @@ const attachments = ref<any[]>([]);
 const loading = ref(false);
 const auth = useAuthStore();
 const study = useStudyStore();
+const permission = usePermission();
 const members = ref<any[]>([]);
 const previewVisible = ref(false);
 const previewUrl = ref("");
@@ -203,11 +205,8 @@ const preview = (row: any) => {
 
 const canDelete = (row: any) => {
   if (props.readonly) return false;
-  const userId = auth.user?.id;
-  const projectRole = getProjectRole(study.currentStudy, study.currentStudyRole);
-  const ownerId =
-    row.uploaded_by_id || (row.uploaded_by && typeof row.uploaded_by === "object" ? row.uploaded_by.id : row.uploaded_by);
-  return userId === ownerId || isSystemAdmin(auth.user) || projectRole === "PM";
+  const action = props.entityType === "knowledge_note" ? "shared.library.write" : "file.attachment.delete";
+  return isSystemAdmin(auth.user) || permission.can(action);
 };
 
 const remove = async (row: any) => {