统一项目权限读取模型

1、合并列表与详情读取权限，统一使用 subjects:read、project_members:read、monitoring_issues:read 等业务读取 key。

2、增加历史读取权限 key 的兼容映射，确保存量项目权限覆盖值不会丢失。

3、同步前端权限工具、路由权限与权限管理页面，避免继续引用已合并的旧权限 key。

4、补充项目角色启停保护与抽屉未保存变更守卫，防止停用 PM 或仍有关联成员的角色。

backend/app/api/v1/members.py

@@ -142,10 +142,10 @@ async def add_member(
 @router.get(
     "/",
     response_model=list[StudyMemberReadWithUser],
-    dependencies=[Depends(require_api_permission("project_members:list"))],
+    dependencies=[Depends(require_api_permission("project_members:read"))],
 )
 @register_api_endpoint(
-    endpoint_key="project_members:list",
+    endpoint_key="project_members:read",
     module="project_members",
     action="read",
     description="查询项目成员列表",
@@ -188,10 +188,10 @@ async def list_members(
 @router.get(
     "/candidates",
     response_model=list[UserResponse],
-    dependencies=[Depends(require_api_permission("project_members:candidates"))],
+    dependencies=[Depends(require_api_permission("project_members:read"))],
 )
 @register_api_endpoint(
-    endpoint_key="project_members:candidates",
+    endpoint_key="project_members:read",
     module="project_members",
     action="read",
     description="查询项目成员候选人",