feat(iit): QC deep fix + V3.1 architecture plan + project member management

QC System Deep Fix:
- HardRuleEngine: add null tolerance + field availability pre-check (skipped status)
- SkillRunner: baseline data merge for follow-up events + field availability check
- QcReportService: record-level pass rate calculation + accurate LLM XML report
- iitBatchController: legacy log cleanup (eventId=null) + upsert RecordSummary
- seed-iit-qc-rules: null/empty string tolerance + applicableEvents config

V3.1 Architecture Design (docs only, no code changes):
- QC engine V3.1 plan: 5-level data structure (CDISC ODM) + D1-D7 dimensions
- Three-batch implementation strategy (A: foundation, B: bubbling, C: new engines)
- Architecture team review: 4 whitepapers reviewed + feedback doc + 4 critical suggestions
- CRA Agent strategy roadmap + CRA 4-tool explanation doc for clinical experts

Project Member Management:
- Cross-tenant member search and assignment (remove tenant restriction)
- IIT project detail page enhancement with tabbed layout (KB + members)
- IitProjectContext for business-side project selection
- System-KB route access control adjustment for project operators

Frontend:
- AdminLayout sidebar menu restructure
- IitLayout with project context provider
- IitMemberManagePage new component
- Business-side pages adapt to project context

Prisma:
- 2 new migrations (user-project RBAC + is_demo flag)
- Schema updates for project member management

Made-with: Cursor

backend/src/index.ts

@@ -111,19 +111,27 @@ import { userRoutes } from './modules/admin/routes/userRoutes.js';
 import { statsRoutes, userOverviewRoute } from './modules/admin/routes/statsRoutes.js';
 import { systemKbRoutes } from './modules/admin/system-kb/index.js';
 import { iitProjectRoutes, iitQcRuleRoutes, iitUserMappingRoutes, iitBatchRoutes, iitQcCockpitRoutes, iitEqueryRoutes } from './modules/admin/iit-projects/index.js';
+import { authenticate, requireRoles } from './common/auth/auth.middleware.js';
 await fastify.register(tenantRoutes, { prefix: '/api/admin/tenants' });
 await fastify.register(moduleRoutes, { prefix: '/api/admin/modules' });
 await fastify.register(userRoutes, { prefix: '/api/admin/users' });
 await fastify.register(statsRoutes, { prefix: '/api/admin/stats' });
 await fastify.register(userOverviewRoute, { prefix: '/api/admin/users' });
 await fastify.register(systemKbRoutes, { prefix: '/api/v1/admin/system-kb' });
-await fastify.register(iitProjectRoutes, { prefix: '/api/v1/admin/iit-projects' });
-await fastify.register(iitQcRuleRoutes, { prefix: '/api/v1/admin/iit-projects' });
-await fastify.register(iitUserMappingRoutes, { prefix: '/api/v1/admin/iit-projects' });
-await fastify.register(iitBatchRoutes, { prefix: '/api/v1/admin/iit-projects' });  // 一键全量质控/汇总
-await fastify.register(iitQcCockpitRoutes, { prefix: '/api/v1/admin/iit-projects' });  // 质控驾驶舱
-await fastify.register(iitEqueryRoutes, { prefix: '/api/v1/admin/iit-projects' });  // eQuery 闭环
-logger.info('✅ 运营管理路由已注册: /api/admin/tenants, /api/admin/modules, /api/admin/users, /api/admin/stats, /api/v1/admin/system-kb, /api/v1/admin/iit-projects');
+
+// IIT 项目管理路由 — 认证 + 角色守卫（SUPER_ADMIN, PROMPT_ENGINEER, IIT_OPERATOR, PHARMA_ADMIN, HOSPITAL_ADMIN 可访问）
+await fastify.register(async (scope) => {
+  scope.addHook('preHandler', authenticate);
+  scope.addHook('preHandler', requireRoles('SUPER_ADMIN', 'PROMPT_ENGINEER', 'IIT_OPERATOR', 'PHARMA_ADMIN', 'HOSPITAL_ADMIN'));
+  await scope.register(iitProjectRoutes);
+  await scope.register(iitQcRuleRoutes);
+  await scope.register(iitUserMappingRoutes);
+  await scope.register(iitBatchRoutes);
+  await scope.register(iitQcCockpitRoutes);
+  await scope.register(iitEqueryRoutes);
+}, { prefix: '/api/v1/admin/iit-projects' });
+
+logger.info('✅ 运营管理路由已注册: /api/admin/tenants, /api/admin/modules, /api/admin/users, /api/admin/stats, /api/v1/admin/system-kb, /api/v1/admin/iit-projects (authenticated)');
 
 // ============================================
 // 【临时】平台基础设施测试API