收敛用户角色并共享项目库

- 后端限制系统只保留默认 admin 管理员，新建用户固定为标注员，并拒绝观察员或额外管理员角色。

- 将项目、帧、媒体解析、AI 标注、任务、Dashboard 和导出接口改为共享项目库访问，标注员具备同等项目管理和标注能力。

- 前端用户管理移除角色选择和观察员入口，只展示唯一管理员与标注员状态。

- 更新后端/前端测试，覆盖唯一 admin、旧 viewer 归一为标注员、用户删除和共享项目库访问。

- 同步更新 AGENTS 与 doc 文档中的角色权限、共享项目库和测试计划说明。

backend/tests/test_projects.py

@@ -186,7 +186,7 @@ def test_project_and_frame_404s(client):
     assert client.get("/api/projects/999/frames/1").status_code == 404
 
 
-def test_projects_are_scoped_to_authenticated_owner(client, db_session):
+def test_projects_are_shared_between_authenticated_users(client, db_session):
     owner_project = client.post("/api/projects", json={"name": "Owner Project"}).json()
     other_user = User(
         username="other",
@@ -203,14 +203,19 @@ def test_projects_are_scoped_to_authenticated_owner(client, db_session):
     db_session.refresh(other_project)
 
     listing = client.get("/api/projects")
-    assert [project["id"] for project in listing.json()] == [owner_project["id"]]
-    assert client.get(f"/api/projects/{other_project.id}").status_code == 404
+    assert {project["id"] for project in listing.json()} == {owner_project["id"], other_project.id}
+    assert client.get(f"/api/projects/{other_project.id}").status_code == 200
 
     original_auth = client.headers["Authorization"]
     client.headers.update({"Authorization": f"Bearer {create_access_token(other_user)}"})
     try:
         other_listing = client.get("/api/projects")
-        assert [project["id"] for project in other_listing.json()] == [other_project.id]
-        assert client.get(f"/api/projects/{owner_project['id']}").status_code == 404
+        assert {project["id"] for project in other_listing.json()} == {owner_project["id"], other_project.id}
+        assert client.get(f"/api/projects/{owner_project['id']}").status_code == 200
+        renamed = client.patch(f"/api/projects/{owner_project['id']}", json={"name": "Edited By Other"})
+        assert renamed.status_code == 200
+        assert renamed.json()["name"] == "Edited By Other"
     finally:
         client.headers.update({"Authorization": original_auth})
+
+    assert client.get(f"/api/projects/{owner_project['id']}").json()["name"] == "Edited By Other"