权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。

frontend/src/views/knowledge/NoteDetail.vue

@@ -38,11 +38,13 @@ import { useStudyStore } from "../../store/study";
 import { getKnowledgeNote } from "../../api/knowledgeNotes";
 import { fetchSites } from "../../api/sites";
 import AttachmentList from "../../components/attachments/AttachmentList.vue";
+import { usePermission } from "../../utils/permission";
 import { TEXT } from "../../locales";
 
 const route = useRoute();
 const router = useRouter();
 const study = useStudyStore();
+const { can } = usePermission();
 const loading = ref(false);
 const noteId = route.params.noteId as string;
 const studyId = study.currentStudy?.id || "";
@@ -62,7 +64,8 @@ const siteActiveMap = computed(() => {
   });
   return map;
 });
-const isReadOnly = computed(() => !!detail.site_name && siteActiveMap.value[detail.site_name] === false);
+const canWriteSharedLibrary = computed(() => can("shared.library.write"));
+const isReadOnly = computed(() => !canWriteSharedLibrary.value || (!!detail.site_name && siteActiveMap.value[detail.site_name] === false));
 
 const loadSites = async () => {
   if (!studyId) return;
@@ -89,7 +92,7 @@ const load = async () => {
 
 const goEdit = () => {
   if (isReadOnly.value) {
-    ElMessage.warning("中心已停用");
+    ElMessage.warning(canWriteSharedLibrary.value ? "中心已停用" : "权限不足");
     return;
   }
   router.push(`/knowledge/notes/${noteId}/edit`);

frontend/src/views/knowledge/NoteForm.vue

@@ -51,11 +51,13 @@ import { createKnowledgeNote, getKnowledgeNote, updateKnowledgeNote } from "../.
 import { fetchSites } from "../../api/sites";
 import AttachmentList from "../../components/attachments/AttachmentList.vue";
 import StateEmpty from "../../components/StateEmpty.vue";
+import { usePermission } from "../../utils/permission";
 import { TEXT } from "../../locales";
 
 const route = useRoute();
 const router = useRouter();
 const study = useStudyStore();
+const { can } = usePermission();
 const saving = ref(false);
 const sites = ref<any[]>([]);
 
@@ -77,7 +79,8 @@ const siteActiveMap = computed(() => {
   });
   return map;
 });
-const isReadOnly = computed(() => isEdit.value && !!form.site_name && siteActiveMap.value[form.site_name] === false);
+const canWriteSharedLibrary = computed(() => can("shared.library.write"));
+const isReadOnly = computed(() => !canWriteSharedLibrary.value || (isEdit.value && !!form.site_name && siteActiveMap.value[form.site_name] === false));
 
 const loadSites = async () => {
   if (!studyId.value) return;
@@ -107,7 +110,7 @@ const load = async () => {
 const submit = async () => {
   if (!studyId.value) return;
   if (isReadOnly.value) {
-    ElMessage.warning("中心已停用");
+    ElMessage.warning(canWriteSharedLibrary.value ? "中心已停用" : "权限不足");
     return;
   }
   if (!form.site_name) {