fix(api): 项目详情接口增加权限校验 + 新增删除项目接口

1. GET /projects/{id} 增加权限校验：非项目所有者且未被共享时返回403
   （此前任何登录用户都可查看任意项目，存在越权访问漏洞）

2. 新增 DELETE /projects/{id} 接口：仅项目所有者可删除，返回403/404
   - 新增 DeleteProjectUseCase（application层）
   - 仓储层 delete 方法已存在，直接复用
   - 与素材库等模块的权限校验模式保持一致

apps/api/app/api/routes/projects.py

@@ -12,6 +12,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from packages.application import (
     CreateProjectCommand,
     CreateProjectUseCase,
+    DeleteProjectUseCase,
     GetProjectUseCase,
     ListProjectsUseCase,
 )
@@ -39,6 +40,8 @@ def get_project(
     project = use_case.execute(project_id)
     if project is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
+    if not project.can_access(authenticated_user.user.id):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied to project")
     return _to_project_response(project)
 
 
@@ -67,3 +70,22 @@ def create_project(
         owner_user_id=authenticated_user.user.id,
     )
     return _to_project_response(project)
+
+
+@router.delete("/{project_id}")
+def delete_project(
+    project_id: str,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    project_repository: Any = Depends(get_project_repository),
+):
+    use_case = DeleteProjectUseCase(project_repository)
+    try:
+        deleted = use_case.execute(project_id, authenticated_user.user.id)
+    except PermissionError:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the project owner can delete this project",
+        )
+    if not deleted:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
+    return {"message": "Project deleted successfully"}

packages/application/projects.py

@@ -61,6 +61,19 @@ class ShareProjectUseCase:
         return project
 
 
+class DeleteProjectUseCase:
+    def __init__(self, project_repository: ProjectRepository):
+        self.project_repository = project_repository
+
+    def execute(self, project_id: str, user_id: str) -> bool:
+        project = self.project_repository.find_by_id(project_id)
+        if not project:
+            return False
+        if not project.is_owner(user_id):
+            raise PermissionError("只有项目所有者可以删除项目")
+        return self.project_repository.delete(project_id)
+
+
 class UnshareProjectUseCase:
     def __init__(self, project_repository: ProjectRepository):
         self.project_repository = project_repository