revert: restore production to the state before 730d0bd (PM/RBAC work moved to 'pm')

Their three commits (730d0bd, 5a9b543, 387edfb) reached production by push and
auto-deployed. 387edfb expects a users.username column that the live database does
not have, so POST /api/v1/auth/login was returning HTTP 500. Their schema changes
never applied either (projects still has only id, name, description, start_date,
pm_user_id, created_at), so nothing depends on the reverted code.

This commit sets the tree back to exactly a02b3ea — verified with git diff against
it — while keeping history linear: the work itself is preserved on 'pm' at 387edfb.

backend/app/routers/attribute_definitions.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, MaterialAttributeValue, Unit
 from app.models.procurement import LineItemSpec
@@ -14,7 +13,6 @@ from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/attribute-definitions", tags=["attribute-definitions"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def attr_def_to_dict(ad: AttributeDefinition, unit: Unit | None = None) -> dict:
@@ -71,11 +69,7 @@ async def list_attribute_definitions(
 
 
 @router.post("", status_code=201)
-async def create_attribute_definition(
-    payload: AttributeDefinitionCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def create_attribute_definition(payload: AttributeDefinitionCreate, db: AsyncSession = Depends(get_db)):
     duplicate = await db.scalar(select(AttributeDefinition.id).where(AttributeDefinition.attribute_key == payload.attribute_key))
     if duplicate is not None:
         raise ConflictError("ویژگی با این attribute_key قبلاً ثبت شده است", field="attribute_key")
@@ -108,10 +102,7 @@ async def get_attribute_definition(
 
 @router.patch("/{definition_id}")
 async def update_attribute_definition(
-    definition_id,
-    payload: AttributeDefinitionUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    definition_id, payload: AttributeDefinitionUpdate, db: AsyncSession = Depends(get_db)
 ):
     ad = await db.get(AttributeDefinition, definition_id)
     if ad is None:
@@ -145,11 +136,7 @@ async def update_attribute_definition(
 
 
 @router.delete("/{definition_id}")
-async def delete_attribute_definition(
-    definition_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_attribute_definition(definition_id, db: AsyncSession = Depends(get_db)):
     ad = await db.get(AttributeDefinition, definition_id)
     if ad is None:
         raise NotFoundError("تعریف ویژگی یافت نشد")