完善项目级权限与项目管理入口

- 新增项目成员候选用户接口，避免 PM 读取全局用户列表
- 按项目角色和权限矩阵控制项目管理、成员、中心与审计入口
- 合并侧边栏管理后台入口，统一从项目管理进入成员等模块
- 加强成员管理安全约束，禁止 PM 修改自己、系统管理员或更高权限角色
- 修复多项目角色缓存串用问题，并补充前后端回归测试

backend/tests/test_project_management_permissions_static.py

@@ -19,6 +19,13 @@ def test_project_permission_routes_are_registered():
     assert 'prefix="/studies/{study_id}/permissions"' in source
 
 
+def test_project_permission_updates_use_project_member_write_permission():
+    source = (ROOT / "app/api/v1/project_permissions.py").read_text(encoding="utf-8")
+
+    assert 'require_study_permission("project_members", "write")' in source
+    assert 'require_roles(["ADMIN"])' not in source
+
+
 def test_project_member_writes_use_saved_permission_matrix():
     source = (ROOT / "app/api/v1/members.py").read_text(encoding="utf-8")
 
@@ -26,6 +33,31 @@ def test_project_member_writes_use_saved_permission_matrix():
     assert 'require_study_roles(["ADMIN", "PM"])' not in source
 
 
+def test_project_member_candidates_use_project_write_permission():
+    source = (ROOT / "app/api/v1/members.py").read_text(encoding="utf-8")
+    user_crud_source = (ROOT / "app/crud/user.py").read_text(encoding="utf-8")
+
+    assert '"/candidates"' in source
+    assert 'response_model=list[UserResponse]' in source
+    assert 'dependencies=[Depends(require_study_permission("project_members", "write"))]' in source
+    assert "list_active_member_candidates_for_study" in source
+    assert "User.status == UserStatus.ACTIVE" in user_crud_source
+    assert ".where(~existing_member)" in user_crud_source
+
+
+def test_project_member_mutation_blocks_self_and_higher_role_changes():
+    source = (ROOT / "app/api/v1/members.py").read_text(encoding="utf-8")
+
+    assert "PROJECT_ROLE_RANK" in source
+    assert 'if target_member and target_member.user_id == current_user.id:' in source
+    assert "不能修改自己的项目成员权限" in source
+    assert "不能修改系统管理员账号的项目权限" in source
+    assert 'if _role_value(target_user) == "ADMIN":' in source
+    assert "不能修改权限高于自己的项目成员" in source
+    assert "不能授予高于自己的项目角色" in source
+    assert "_ensure_member_mutation_allowed(" in source
+
+
 def test_business_modules_use_saved_permission_matrix():
     expected = {
         "overview.py": [