完善项目级权限与项目管理入口

- 新增项目成员候选用户接口，避免 PM 读取全局用户列表
- 按项目角色和权限矩阵控制项目管理、成员、中心与审计入口
- 合并侧边栏管理后台入口，统一从项目管理进入成员等模块
- 加强成员管理安全约束，禁止 PM 修改自己、系统管理员或更高权限角色
- 修复多项目角色缓存串用问题，并补充前后端回归测试

backend/app/api/v1/members.py

@@ -10,10 +10,20 @@ from app.crud import member as member_crud
 from app.crud import study as study_crud
 from app.crud import user as user_crud
 from app.schemas.member import StudyMemberCreate, StudyMemberRead, StudyMemberReadWithUser, StudyMemberUpdate
-from app.schemas.user import UserDisplay
+from app.schemas.user import UserResponse
 
 router = APIRouter()
 
+PROJECT_ROLE_RANK = {
+    "ADMIN": 100,
+    "PM": 80,
+    "QA": 60,
+    "PV": 50,
+    "MEDICAL_REVIEW": 50,
+    "CRA": 40,
+    "IMP": 40,
+}
+
 
 async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     study = await study_crud.get(db, study_id)
@@ -22,6 +32,44 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     return study
 
 
+def _role_value(user) -> str:
+    return user.role.value if hasattr(user.role, "value") else str(user.role)
+
+
+def _role_rank(role: str | None) -> int:
+    return PROJECT_ROLE_RANK.get(role or "", 0)
+
+
+async def _ensure_member_mutation_allowed(
+    db: AsyncSession,
+    study_id: uuid.UUID,
+    current_user,
+    *,
+    target_member=None,
+    target_role: str | None = None,
+) -> None:
+    if _role_value(current_user) == "ADMIN":
+        return
+
+    actor_member = await member_crud.get_member(db, study_id, current_user.id)
+    actor_role = actor_member.role_in_study if actor_member else None
+    actor_rank = _role_rank(actor_role)
+
+    if target_member and target_member.user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能修改自己的项目成员权限")
+
+    if target_member:
+        target_user = await user_crud.get_by_id(db, target_member.user_id)
+        if _role_value(target_user) == "ADMIN":
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能修改系统管理员账号的项目权限")
+
+    if target_member and _role_rank(target_member.role_in_study) > actor_rank:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能修改权限高于自己的项目成员")
+
+    if target_role and _role_rank(target_role) > actor_rank:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能授予高于自己的项目角色")
+
+
 @router.post(
     "/",
     response_model=StudyMemberRead,
@@ -35,8 +83,16 @@ async def add_member(
     current_user=Depends(get_current_user),
 ) -> StudyMemberRead:
     await _ensure_study_exists(db, study_id)
+    await _ensure_member_mutation_allowed(db, study_id, current_user, target_role=member_in.role_in_study)
     existing = await member_crud.get_member(db, study_id, member_in.user_id)
     if existing:
+        await _ensure_member_mutation_allowed(
+            db,
+            study_id,
+            current_user,
+            target_member=existing,
+            target_role=member_in.role_in_study,
+        )
         if not existing.is_active:
             updated = await member_crud.update_member(
                 db,
@@ -106,12 +162,28 @@ async def list_members(
                 role_in_study=m.role_in_study,
                 is_active=m.is_active,
                 added_at=m.added_at,
-                user=UserDisplay.model_validate(user) if user else None,
+                user=UserResponse.model_validate(user) if user else None,
             )
         )
     return result
 
 
+@router.get(
+    "/candidates",
+    response_model=list[UserResponse],
+    dependencies=[Depends(require_study_permission("project_members", "write"))],
+)
+async def list_member_candidates(
+    study_id: uuid.UUID,
+    skip: int = 0,
+    limit: int = 500,
+    db: AsyncSession = Depends(get_db_session),
+) -> list[UserResponse]:
+    await _ensure_study_exists(db, study_id)
+    users = await user_crud.list_active_member_candidates_for_study(db, study_id, skip=skip, limit=limit)
+    return [UserResponse.model_validate(user) for user in users]
+
+
 @router.patch(
     "/{member_id}",
     response_model=StudyMemberRead,
@@ -128,6 +200,13 @@ async def update_member(
     member = await member_crud.get_member_by_id(db, member_id)
     if not member or member.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="成员不存在")
+    await _ensure_member_mutation_allowed(
+        db,
+        study_id,
+        current_user,
+        target_member=member,
+        target_role=member_in.role_in_study,
+    )
     before_data = {"role_in_study": member.role_in_study, "is_active": member.is_active}
     updated = await member_crud.update_member(db, member, member_in)
     after_data = {"role_in_study": updated.role_in_study, "is_active": updated.is_active}
@@ -159,6 +238,7 @@ async def remove_member(
     member = await member_crud.get_member_by_id(db, member_id)
     if not member or member.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="成员不存在")
+    await _ensure_member_mutation_allowed(db, study_id, current_user, target_member=member)
     before_data = {"role_in_study": member.role_in_study, "is_active": member.is_active}
     removed = await member_crud.remove_member(db, member)
     await audit_crud.log_action(

backend/app/api/v1/project_permissions.py

@@ -6,7 +6,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member
+from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_permission
 from app.core.project_permissions import PROJECT_PERMISSION_MODULES, get_project_role_permissions, replace_project_role_permissions
 from app.crud import audit as audit_crud
 from app.crud import study as study_crud
@@ -33,7 +33,7 @@ async def get_permissions(
     return ProjectRolePermissionsRead(modules=modules, roles=roles)
 
 
-@router.put("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_roles(["ADMIN"]))])
+@router.put("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_study_permission("project_members", "write"))])
 async def update_permissions(
     study_id: uuid.UUID,
     payload: ProjectRolePermissionsUpdate,