revert: restore production to the state before 730d0bd (PM/RBAC work moved to 'pm')

Their three commits (730d0bd, 5a9b543, 387edfb) reached production by push and
auto-deployed. 387edfb expects a users.username column that the live database does
not have, so POST /api/v1/auth/login was returning HTTP 500. Their schema changes
never applied either (projects still has only id, name, description, start_date,
pm_user_id, created_at), so nothing depends on the reverted code.

This commit sets the tree back to exactly a02b3ea — verified with git diff against
it — while keeping history linear: the work itself is preserved on 'pm' at 387edfb.

backend/app/routers/schedule_steps.py

@@ -3,7 +3,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import Termsheet, TermsheetScheduleStep
 from app.schemas.procurement import ScheduleStepCreate, ScheduleStepUpdate
@@ -16,7 +15,6 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/termsheets/{termsheet_id}/schedule-steps",
     tags=["schedule-steps"],
 )
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 async def _termsheet_or_404(db: AsyncSession, quote_id, termsheet_id) -> Termsheet:
@@ -59,11 +57,7 @@ async def list_schedule_steps(
 
 @router.post("", status_code=201)
 async def create_schedule_step(
-    quote_id,
-    termsheet_id,
-    payload: ScheduleStepCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, termsheet_id, payload: ScheduleStepCreate, db: AsyncSession = Depends(get_db)
 ):
     ts = await _termsheet_or_404(db, quote_id, termsheet_id)
     step_no = payload.step_no
@@ -90,12 +84,7 @@ async def create_schedule_step(
 
 @router.patch("/{step_id}")
 async def update_schedule_step(
-    quote_id,
-    termsheet_id,
-    step_id,
-    payload: ScheduleStepUpdate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    quote_id, termsheet_id, step_id, payload: ScheduleStepUpdate, db: AsyncSession = Depends(get_db)
 ):
     step = await _step_or_404(db, termsheet_id, step_id)
     if payload.step_no is not None and payload.step_no != step.step_no:
@@ -120,13 +109,7 @@ async def update_schedule_step(
 
 
 @router.delete("/{step_id}")
-async def delete_schedule_step(
-    quote_id,
-    termsheet_id,
-    step_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_schedule_step(quote_id, termsheet_id, step_id, db: AsyncSession = Depends(get_db)):
     step = await _step_or_404(db, termsheet_id, step_id)
     count = await db.scalar(
         select(func.count()).select_from(TermsheetScheduleStep).where(