权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。

frontend/src/views/ia/KnowledgeNotes.vue

@@ -24,7 +24,7 @@
             <el-button @click="resetFilters">{{ TEXT.common.actions.reset }}</el-button>
           </div>
           <div class="filter-spacer"></div>
-          <el-button type="primary" @click="goNew">
+          <el-button v-if="canWriteSharedLibrary" type="primary" @click="goNew">
             {{ TEXT.modules.knowledgeNotes.newTitle }}
           </el-button>
         </el-form>
@@ -48,6 +48,7 @@
           <el-table-column :label="TEXT.common.labels.actions" width="120">
             <template #default="scope">
               <el-button
+                v-if="canWriteSharedLibrary"
                 link
                 type="danger"
                 size="small"
@@ -75,10 +76,12 @@ import { useStudyStore } from "../../store/study";
 import { listKnowledgeNotes, deleteKnowledgeNote } from "../../api/knowledgeNotes";
 import { fetchSites } from "../../api/sites";
 import { displayDateTime } from "../../utils/display";
+import { usePermission } from "../../utils/permission";
 import { TEXT } from "../../locales";
 
 const router = useRouter();
 const study = useStudyStore();
+const { can } = usePermission();
 const loading = ref(false);
 const items = ref<any[]>([]);
 const sites = ref<any[]>([]);
@@ -109,6 +112,7 @@ const filteredItems = computed(() => {
 const sortedItems = computed(() =>
   [...filteredItems.value].sort((a, b) => Number(isInactiveSite(a?.site_name)) - Number(isInactiveSite(b?.site_name)))
 );
+const canWriteSharedLibrary = computed(() => can("shared.library.write"));
 
 const loadSites = async () => {
   const studyId = study.currentStudy?.id;