feat(server): add project RBAC and guarded workflows

tests/api/test_sensor_placement_endpoints.py

@@ -2,6 +2,7 @@ from datetime import datetime, timezone
 from io import BytesIO
 from types import SimpleNamespace
 
+import pytest
 from fastapi.testclient import TestClient
 
 from tests.conftest import build_test_app, install_stub, load_module_from_path
@@ -254,21 +255,25 @@ def test_optimize_rejects_viewer_project_role(monkeypatch):
     assert response.status_code == 403
 
 
-def test_project_owner_and_admin_can_optimize(monkeypatch):
+@pytest.mark.parametrize(
+    "project_role",
+    ["owner", "admin", "modeler", "dispatcher", "auditor"],
+)
+def test_legacy_project_roles_cannot_optimize(monkeypatch, project_role):
     module = _load_module(monkeypatch)
-    for project_role in ("owner", "admin"):
-        response = _client(module, project_role=project_role).post(
-            "/api/v1/sensor-placement-schemes/optimize",
-            json={
-                "network": "tjwater",
-                "scheme_name": f"{project_role}方案",
-                "sensor_type": "pressure",
-                "method": "kmeans",
-                "sensor_count": 2,
-                "min_diameter": 300,
-            },
-        )
-        assert response.status_code == 200
+    response = _client(module, project_role=project_role).post(
+        "/api/v1/sensor-placement-schemes/optimize",
+        json={
+            "network": "tjwater",
+            "scheme_name": f"{project_role}方案",
+            "sensor_type": "pressure",
+            "method": "kmeans",
+            "sensor_count": 2,
+            "min_diameter": 300,
+        },
+    )
+
+    assert response.status_code == 403
 
 
 def test_optimize_maps_running_project_job_to_409(monkeypatch):