feat: 平台治理与权限体系完善，存储进度/GPU预留/审批中心与日志整合

- 平台治理: 租户用户权限层次、资源ACL、审批中心与审批模板、访问申请
- 存储: MinIO 存储进度迁移、对象存储安全加固与测试
- 计算: GPU 资源预留、compute 轮询与同步增强
- 权限: permission v2 迁移、权限安全验收测试
- 日志: 后端运行日志中文说明、操作日志整合
- 数据处理/评测: 数据转换与模型评测优化

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/modules/project/router.py

@@ -32,16 +32,24 @@ def _require_approval_or_admin(
     resource_id: str,
     current_user: dict[str, Any],
     action_desc: str = "",
+    action: str = "project.change",
 ) -> dict[str, Any] | None:
     """高风险操作审批旁路：admin 直接放行，普通用户创建审批实例（code=202）。"""
     if is_admin(current_user):
         return None
+    if not has_resource_access(resource_type, resource_id, current_user, "write"):
+        raise fail(403, "no permission to request this project change")
     store = get_platform_store()
+    if store.consume_approved_approval(resource_type, resource_id, str(current_user.get("id") or ""), action):
+        return None
     instance = store.create_approval_instance({
         "resource_type": resource_type,
         "resource_id": resource_id,
         "applicant_id": current_user.get("id"),
         "template_id": None,
+        "action": action,
+        "tenant_id": current_user.get("tenant_id") or "default",
+        "reason": action_desc,
     })
     return {
         "code": 202,
@@ -68,12 +76,20 @@ def list_projects(
 
 
 @router.post("")
-def create_project(payload: dict[str, Any] = Body(...), request: Request = None) -> dict[str, Any]:
+def create_project(payload: dict[str, Any] = Body(...), request: Request = None, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
+    if not is_admin(current_user) and str(payload.get("tenant_id") or current_user.get("tenant_id") or "default") != str(current_user.get("tenant_id") or "default"):
+        raise fail(403, "cannot create project in another tenant")
+    payload.setdefault("tenant_id", current_user.get("tenant_id") or "default")
+    payload.setdefault("create_by", current_user.get("id"))
     store = get_platform_store()
+    try:
+        store.assert_active_tenant(payload["tenant_id"])
+    except ValueError as exc:
+        raise fail(400, str(exc))
     proj = store.create_project(payload)
     store.record_audit(
         action="project.create",
-        actor_id=_actor(request) if request else None,
+        actor_id=current_user.get("id"),
         target_type="project",
         target_id=proj["id"],
         tenant_id=proj.get("tenant_id"),
@@ -109,7 +125,7 @@ def update_project(
         raise fail(404, "project not found")
     store.record_audit(
         action="project.update",
-        actor_id=_actor(request) if request else None,
+        actor_id=current_user.get("id"),
         target_type="project",
         target_id=project_id,
         tenant_id=proj.get("tenant_id"),
@@ -125,7 +141,7 @@ def archive_project(
     current_user: dict = Depends(get_current_user),
 ) -> dict[str, Any]:
     _require_no_pending_approval("project", project_id)
-    pending = _require_approval_or_admin("project", project_id, current_user, f"归档项目 {project_id}")
+    pending = _require_approval_or_admin("project", project_id, current_user, f"归档项目 {project_id}", "project.archive")
     if pending:
         return pending
     store = get_platform_store()
@@ -135,7 +151,7 @@ def archive_project(
         raise fail(404, "project not found")
     store.record_audit(
         action="project.archive",
-        actor_id=_actor(request) if request else None,
+        actor_id=current_user.get("id"),
         target_type="project",
         target_id=project_id,
         tenant_id=proj.get("tenant_id"),
@@ -150,14 +166,14 @@ def delete_project(
     current_user: dict = Depends(get_current_user),
 ) -> dict[str, Any]:
     _require_no_pending_approval("project", project_id)
-    pending = _require_approval_or_admin("project", project_id, current_user, f"删除项目 {project_id}")
+    pending = _require_approval_or_admin("project", project_id, current_user, f"删除项目 {project_id}", "project.delete")
     if pending:
         return pending
     store = get_platform_store()
     store.delete_project(project_id)
     store.record_audit(
         action="project.delete",
-        actor_id=_actor(request) if request else None,
+        actor_id=current_user.get("id"),
         target_type="project",
         target_id=project_id,
     )
@@ -190,7 +206,7 @@ def add_member(
         raise fail(404, "project not found")
     store.record_audit(
         action="project.member.add",
-        actor_id=_actor(request) if request else None,
+        actor_id=current_user.get("id"),
         target_type="project.member",
         target_id=project_id,
         detail=f"user_id={payload.get('user_id')},role={payload.get('role')}",
@@ -215,7 +231,7 @@ def update_member(
         raise fail(404, "project or member not found")
     store.record_audit(
         action="project.member.update",
-        actor_id=_actor(request) if request else None,
+        actor_id=current_user.get("id"),
         target_type="project.member",
         target_id=project_id,
         detail=f"user_id={user_id},role={payload.get('role')}",