权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。

frontend/src/views/admin/ProjectDetail.vue

@@ -1932,6 +1932,7 @@ import StateLoading from "../../components/StateLoading.vue";
 import { useStudyStore } from "../../store/study";
 import { useAuthStore } from "../../store/auth";
 import { TEXT, requiredMessage } from "../../locales";
+import { isSystemAdmin } from "../../utils/roles";
 import { groupErrorsBySection, parseFieldPath, type SetupValidationError } from "../../utils/setupFieldLocator";
 import { buildSetupReadableDiffRows, serializeDiffValue, type SetupDiffRow } from "../../utils/setupDiffRows";
 import {
@@ -2402,8 +2403,7 @@ const setupDraft = reactive<SetupConfigDraft>({
 
 const storageKey = computed(() => `ctms_setup_config_draft_${String(route.params.projectId || "")}`);
 const projectDraftStorageKey = computed(() => `ctms_setup_project_draft_${String(route.params.projectId || "")}`);
-const setupRole = computed(() => String(project.value?.role_in_study || "").toUpperCase());
-const canManageSetup = computed(() => ["ADMIN", "PM"].includes(setupRole.value));
+const canManageSetup = computed(() => isSystemAdmin(authStore.user));
 const isPreviewView = computed(() => setupViewMode.value === "preview");
 const isPublishedVersionView = computed(() => setupViewMode.value === "published");
 const isPublishedView = computed(() => isPreviewView.value || isPublishedVersionView.value);
@@ -4419,6 +4419,7 @@ const refreshProjectDisplayAfterPublish = async () => {
     formBaselineSnapshot.value = serializeFormForCompare();
     if (studyStore.currentStudy?.id === project.value.id) {
       studyStore.setCurrentStudy({ ...(studyStore.currentStudy as Study), ...project.value } as Study);
+      await studyStore.loadCurrentStudyPermissions().catch(() => {});
     }
   } catch {
     // Ignore refresh errors to avoid breaking publish success flow.
@@ -5559,9 +5560,10 @@ const confirmPublishConfig = async () => {
   }
 };
 
-const enterProject = () => {
+const enterProject = async () => {
   if (!project.value) return;
   studyStore.setCurrentStudy(project.value);
+  await studyStore.loadCurrentStudyPermissions().catch(() => {});
   router.push("/project/overview");
 };
 const goMembers = () => {