feat(project): group project pages under a management menu

Add a second-level project management directory to match the requested navigation hierarchy. Preserve page permissions and legacy URLs, and migrate existing role grants to include the new ancestor. User will validate after integration.

docs/sql/migrations/2026-11-04-project_management_group.sql

@@ -0,0 +1,46 @@
+-- Issue #13：在 project_all_permission 之后执行，可重复执行。
+-- 项目 → 项目管理 → 四个原页面。保留页面 ID/权限及移动菜单。
+-- 全部项目权限仍挂在项目一级节点，不以目录授权隐式授予业务权限。
+START TRANSACTION;
+
+INSERT INTO sys_menu (id, menu_name, parent_id, menu_type, path, component, perms,
+    is_frame, visible, status, tenant_no, order_num, create_dept_id, create_time, update_time, del_flag)
+SELECT MD5(CONCAT(top_menu.tenant_no, ':menu:project:management')), '项目管理', top_menu.id,
+    'M', 'management', '', 'menu:project:management', 1, '1', '1', top_menu.tenant_no,
+    1, '', NOW(), NOW(), 0
+FROM sys_menu top_menu
+WHERE top_menu.perms='menu:project' AND top_menu.del_flag=0
+AND NOT EXISTS (SELECT 1 FROM sys_menu existing
+    WHERE existing.tenant_no=top_menu.tenant_no AND existing.perms='menu:project:management');
+
+UPDATE sys_menu leaf
+JOIN sys_menu group_menu ON group_menu.tenant_no=leaf.tenant_no
+    AND group_menu.perms='menu:project:management' AND group_menu.del_flag=0
+SET leaf.parent_id=group_menu.id, leaf.update_time=NOW()
+WHERE leaf.del_flag=0 AND leaf.perms IN (
+    'project:team:list', 'project:project:list', 'project:statistics:list', 'project:assignment:edit');
+
+-- 仅已有页面/编辑按钮授权的角色补齐目录、项目一级和 Web 根。
+-- 只拥有全部项目选择权限的角色不增加四个管理页面的访问权限。
+INSERT INTO sys_role_menu (id, role_id, menu_id, tenant_no, create_dept_id, create_time, update_time, del_flag)
+SELECT DISTINCT MD5(CONCAT(grant_row.tenant_no, ':project-management-ancestor:', grant_row.role_id, ':', ancestor.id)),
+    grant_row.role_id, ancestor.id, grant_row.tenant_no, '', NOW(), NOW(), 0
+FROM sys_role_menu grant_row
+JOIN sys_role role_row ON role_row.id=grant_row.role_id AND role_row.tenant_no=grant_row.tenant_no
+    AND role_row.del_flag=0
+JOIN sys_menu leaf ON leaf.id=grant_row.menu_id AND leaf.tenant_no=grant_row.tenant_no
+    AND leaf.del_flag=0 AND leaf.perms IN ('project:team:list', 'project:project:list',
+        'project:statistics:list', 'project:assignment:edit', 'project:team:edit', 'project:project:edit')
+JOIN sys_menu group_menu ON group_menu.tenant_no=grant_row.tenant_no
+    AND group_menu.perms='menu:project:management' AND group_menu.del_flag=0
+JOIN sys_menu top_menu ON top_menu.id=group_menu.parent_id AND top_menu.tenant_no=grant_row.tenant_no
+    AND top_menu.perms='menu:project' AND top_menu.del_flag=0
+JOIN sys_menu ancestor ON ancestor.tenant_no=grant_row.tenant_no AND ancestor.del_flag=0
+    AND ancestor.id IN (group_menu.id, top_menu.id, top_menu.parent_id)
+WHERE grant_row.del_flag=0
+AND NOT EXISTS (SELECT 1 FROM sys_role_menu existing
+    WHERE existing.tenant_no=grant_row.tenant_no AND existing.role_id=grant_row.role_id
+        AND existing.menu_id=ancestor.id AND existing.del_flag=0)
+ON DUPLICATE KEY UPDATE del_flag=0, update_time=NOW();
+
+COMMIT;