feat(project): enforce team-scoped selection with explicit all-project permission

Separate cross-team selection from attribution maintenance and apply the same scope to options, history filters and writes. Add an opt-in tenant permission without granting existing roles.

Protect authorization mutation paths against self-grants, validate tenant targets and links, and include menu ancestors atomically. Cover role union, revocation, mobile writes and administration boundaries with regression tests.

docs/sql/migrations/2026-11-02-project_all_permission.sql

@@ -0,0 +1,11 @@
+-- Issue #13：在 project_top_menu 之后执行，可重复执行。
+-- 独立功能权限，挂在“项目”一级节点下，授权时无需同时授予项目资料管理权限。
+-- 不从归属维护或管理员角色继承授权，不写 sys_role_menu；由角色管理显式勾选。
+INSERT INTO sys_menu (id, menu_name, parent_id, menu_type, path, component, perms,
+    is_frame, visible, status, tenant_no, order_num, create_dept_id, create_time, update_time, del_flag)
+SELECT MD5(CONCAT(parent.tenant_no, ':project:project:all')), '全部项目', parent.id,
+    'F', '', '', 'project:project:all', 1, '0', '1', parent.tenant_no, 20, '', NOW(), NOW(), 0
+FROM sys_menu parent
+WHERE parent.perms='menu:project' AND parent.del_flag=0 AND parent.status='1'
+AND NOT EXISTS (SELECT 1 FROM sys_menu existing
+    WHERE existing.tenant_no=parent.tenant_no AND existing.perms='project:project:all');