feat(server): add project RBAC and guarded workflows

app/api/v1/endpoints/sensor_placement.py

@@ -41,19 +41,14 @@ def _project_network(network: str, project_context: ProjectContext) -> str:
     return project_context.project_code
 
 
-def _can_modify_project(project_context: ProjectContext, current_user: Any) -> bool:
-    return bool(
-        project_context.project_role in {"owner", "admin", "member"}
-        or getattr(current_user, "role", None) == "admin"
-        or getattr(current_user, "is_superuser", False)
-    )
+def _can_modify_project(project_context: ProjectContext) -> bool:
+    return project_context.project_role == "member"
 
 
 def _require_project_write(
     project_context: ProjectContext,
-    current_user: Any,
 ) -> None:
-    if not _can_modify_project(project_context, current_user):
+    if not _can_modify_project(project_context):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="当前项目角色为只读，不能修改监测点方案",
@@ -88,7 +83,7 @@ def _get_scheme_response(
         return {
             **scheme,
             "can_edit": (
-                _can_modify_project(project_context, current_user)
+                _can_modify_project(project_context)
                 and can_edit_sensor_placement(current_user, scheme)
             ),
         }
@@ -110,7 +105,7 @@ async def optimize_sensor_placement_scheme(
     current_user=Depends(get_current_metadata_user),
 ) -> dict[str, Any]:
     network = _project_network(payload.network, project_context)
-    _require_project_write(project_context, current_user)
+    _require_project_write(project_context)
     optimizer = (
         pressure_sensor_placement_sensitivity
         if payload.method == "sensitivity"
@@ -173,7 +168,7 @@ async def overwrite_sensor_placement_scheme(
     current_user=Depends(get_current_metadata_user),
 ) -> dict[str, Any]:
     network = _project_network(network, project_context)
-    _require_project_write(project_context, current_user)
+    _require_project_write(project_context)
     scheme = _get_scheme_response(
         network,
         scheme_id,