feat(pm): multi-project PMs (1:N) with project switching, scoping validation and org multi-select

Task 1 — PM 1:N + access-loss handling:
- projects.pm_user_id had no UNIQUE constraint (verified live + in schema); added a lookup index via init_db
- auth: UserContext.project_ids = every project of a PM (oldest first); project_id stays the first for compatibility
- GET /users/me/projects — assigned projects of the caller (drives the switcher + revocation validation)
- login / /users/me / /users list now return the full projects array per user
- /inventory/* and /pm/* scopes accept an explicit ?project_id=… and verify the PM manages it (403 otherwise); without the param they fall back to the first project; admin/manager use it as an optional filter
- POST /users/{id}/project is multi-aware: assigns one project (replacing that project's previous PM) and KEEPS the user's other assignments; null clears all
- PATCH /projects/{id} accepts pm_user_id (admin / procurement manager only)
- frontend: auth store holds projects + the active project (persisted via the existing localStorage store); RequirePmProjects re-validates on load, falls back when the active project was revoked, and shows a dedicated no-projects screen with logout (no redirect loop, no re-auth)
- Panels menu: «مدیریت انبار» gets a ChevronDown accordion listing the PM's projects with «✓ فعلی»; selecting one switches only the active project and reloads the section data
- inventory/pm API calls now send the active project_id explicitly

Task 2 — Organization page:
- new searchable ProjectMultiSelect combobox (chips with ×, live Persian filtering via normalize, assigned projects hidden) replaces the single select for PM users
- add = PATCH project pm_user_id=<user>; × = pm_user_id=null; table and project cards sync immediately; RBAC unchanged (role column admin-only, combobox editable for admin + procurement manager)

Verified locally: 17 scripted checks — multi-project assignment without unique conflicts, /users/me/projects, explicit project_id authorization (foreign project 403 on /inventory, /pm/on-the-way, /pm/receipts), PM blocked from pm_user_id changes, legacy assign endpoint keeps other assignments, revocation removes the project from the list, zero-project PM gets an empty list and a guarded inventory endpoint. All test data cleaned up afterwards.

backend/app/routers/inventory.py

@@ -59,10 +59,18 @@ class Scope:
     actor: str | None
 
 
-async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db)) -> Scope:
-    """Resolve the caller role/project — Casdoor JWT first, dev headers as fallback."""
-    # Primary path: Casdoor JWT. Role from users.role; PM project from
-    # projects.pm_user_id (single PM per project).
+async def inventory_scope(
+    request: Request,
+    project_id: uuid.UUID | None = Query(default=None, description="پروژه فعال (PM: داده‌های همین پروژه)"),
+    db: AsyncSession = Depends(get_db),
+) -> Scope:
+    """Resolve the caller role/project — Casdoor JWT first, dev headers as fallback.
+
+    The active project is explicit via `?project_id=…`. For a PM the backend
+    verifies they manage that project (projects.pm_user_id, 1:N); without the
+    param it falls back to their first assigned project. Admin / procurement
+    manager may pass it as a filter (no param = all projects).
+    """
     if request.headers.get("authorization"):
         user: UserContext = await get_optional_user(request, db)
         if user is not None:
@@ -70,16 +78,21 @@ async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db))
                 raise ForbiddenError("نقش شما هنوز در سیستم تعیین نشده است")
             # v2.6: مدیر تدارکات = ادمین دفتر — دسترسی فقط‌خواندنی به پنل انبار.
             if user.role == "procurement_manager":
-                return Scope(role="admin", project_id=None, actor=user.display_name)
+                return Scope(role="admin", project_id=project_id, actor=user.display_name)
             if user.role not in ("pm", "admin"):
                 raise ValidationError("نقش نامعتبر است — فقط pm یا admin برای موجودی", field="role")
             if user.role == "pm":
-                if user.project_id is None:
+                allowed = list(user.project_ids or [])
+                if project_id is not None:
+                    if project_id not in allowed:
+                        raise ForbiddenError("این پروژه به شما تخصیص داده نشده است")
+                    return Scope(role="pm", project_id=project_id, actor=user.display_name)
+                if not allowed:
                     raise ValidationError(
                         "کاربر PM به هیچ پروژه‌ای متصل نیست (projects.pm_user_id)", field="project_id"
                     )
-                return Scope(role="pm", project_id=user.project_id, actor=user.display_name)
-            return Scope(role="admin", project_id=None, actor=user.display_name)
+                return Scope(role="pm", project_id=allowed[0], actor=user.display_name)
+            return Scope(role="admin", project_id=project_id, actor=user.display_name)
 
     # Dev fallback: header-based identity (fork's placeholder mode) — only
     # when an explicit X-User-Role header is sent. No auth info at all → 401.
@@ -90,13 +103,14 @@ async def inventory_scope(request: Request, db: AsyncSession = Depends(get_db))
         role = ROLE_ADMIN  # مدیر تدارکات = ادمین (فقط‌خواندنی)
     if role not in (ROLE_PM, ROLE_ADMIN):
         raise ValidationError("نقش نامعتبر است — فقط pm یا admin", field="X-User-Role")
-    raw_project = request.headers.get("x-project-id") or settings.INVENTORY_DEFAULT_PROJECT_ID
-    project_id = None
-    if raw_project:
-        try:
-            project_id = uuid.UUID(str(raw_project))
-        except ValueError:
-            raise ValidationError("شناسه پروژه نامعتبر است", field="X-Project-Id")
+    # The explicit query param wins; otherwise the dev header carries it.
+    if project_id is None:
+        raw_project = request.headers.get("x-project-id") or settings.INVENTORY_DEFAULT_PROJECT_ID
+        if raw_project:
+            try:
+                project_id = uuid.UUID(str(raw_project))
+            except ValueError:
+                raise ValidationError("شناسه پروژه نامعتبر است", field="X-Project-Id")
     if role == ROLE_PM and project_id is None:
         raise ValidationError(
             "برای نقش PM هدر X-Project-Id (پروژه مسئول) الزامی است", field="X-Project-Id"