收敛用户角色并共享项目库

- 后端限制系统只保留默认 admin 管理员，新建用户固定为标注员，并拒绝观察员或额外管理员角色。

- 将项目、帧、媒体解析、AI 标注、任务、Dashboard 和导出接口改为共享项目库访问，标注员具备同等项目管理和标注能力。

- 前端用户管理移除角色选择和观察员入口，只展示唯一管理员与标注员状态。

- 更新后端/前端测试，覆盖唯一 admin、旧 viewer 归一为标注员、用户删除和共享项目库访问。

- 同步更新 AGENTS 与 doc 文档中的角色权限、共享项目库和测试计划说明。

backend/routers/media.py

@@ -72,10 +72,7 @@ async def upload_media(
     file_url = get_presigned_url(object_name, expires=3600)
 
     if project_id:
-        project = db.query(Project).filter(
-            Project.id == project_id,
-            Project.owner_user_id == current_user.id,
-        ).first()
+        project = db.query(Project).filter(Project.id == project_id).first()
         if not project:
             raise HTTPException(status_code=404, detail="Project not found")
         project.video_path = object_name
@@ -141,10 +138,7 @@ async def upload_dicom_batch(
     uploaded = []
 
     if project_id:
-        project = db.query(Project).filter(
-            Project.id == project_id,
-            Project.owner_user_id == current_user.id,
-        ).first()
+        project = db.query(Project).filter(Project.id == project_id).first()
         if not project:
             raise HTTPException(status_code=404, detail="Project not found")
     else:
@@ -202,10 +196,7 @@ def parse_media(
     The Celery worker performs the heavy FFmpeg/OpenCV/pydicom work and
     updates the persisted task record as it progresses.
     """
-    project = db.query(Project).filter(
-        Project.id == project_id,
-        Project.owner_user_id == current_user.id,
-    ).first()
+    project = db.query(Project).filter(Project.id == project_id).first()
     if not project:
         raise HTTPException(status_code=404, detail="Project not found")