完善项目权限前置依赖保存校验

- 以接口权限定义中的 prerequisite_permissions 作为前置依赖单一事实源，生成运行时前置权限映射\n- 保存项目角色权限前预检缺失前置权限与受影响下游权限，未确认时返回 409 调整详情\n- 确认保存时自动合并补齐前置权限与取消下游权限，并提供有效权限矩阵读取接口\n- 前端角色权限编辑改为保存时执行依赖校验，弹窗展示需补充前置权限和受影响下游权限\n- 新增编辑权限取消按钮，清理权限选择即时确认弹窗残留\n- 补充后端接口测试、前端权限编辑测试与优化设计文档

backend/tests/test_api_permissions.py

@@ -99,6 +99,15 @@ def test_read_permissions_do_not_duplicate_list_and_detail_entries():
     assert expected_read_keys <= set(API_ENDPOINT_PERMISSIONS)
 
 
+def test_site_contact_display_source_permissions_cover_non_pm_roles():
+    """负责人展示名来自中心列表，读取角色不应局限于 PM。"""
+    sites_read_roles = set(API_ENDPOINT_PERMISSIONS["sites:read"]["default_roles"])
+    startup_auth_read_roles = set(API_ENDPOINT_PERMISSIONS["startup_auth:read"]["default_roles"])
+
+    assert {"PM", "CRA", "PV", "QA", "CTA"} <= sites_read_roles
+    assert {"PM", "CRA", "PV", "CTA"} <= startup_auth_read_roles
+
+
 @pytest.mark.asyncio
 async def test_legacy_read_permission_overrides_are_folded_into_canonical_read_key(db_session: AsyncSession):
     """历史项目权限中的列表读取 key 应继续作用到合并后的读取权限。"""
@@ -623,10 +632,16 @@ async def test_full_permission_matrix_round_trips_to_backend_checks(db_session:
         for role_index, role in enumerate(configurable_roles)
     }
 
-    matrix = await replace_api_endpoint_permissions(db_session, study_id, payload)
+    matrix = await replace_api_endpoint_permissions(
+        db_session,
+        study_id,
+        payload,
+        confirm_prerequisite_adjustments=True,
+    )
 
     for role in configurable_roles:
-        for endpoint_key, expected in payload[role].items():
+        for endpoint_key in payload[role].keys():
+            expected = matrix[role][endpoint_key]["allowed"]
             assert matrix[role][endpoint_key]["allowed"] is expected
             allowed = await role_has_api_permission(
                 db_session,