feat(erp-pm): integrate unified access matrix, streamline limited procurement flow, and brand as integrated project management, procurement and warehouse platform

backend/app/routers/quotes.py

@@ -169,11 +169,14 @@ async def create_quote(
 ):
     # سطح limited: استعلام فقط برای پروژه‌های عضویت خودش
     if (ctx.panels or {}).get("procurement") == "limited" and ctx.role != "admin":
-        member = set(ctx.member_project_ids or [])
-        wanted = {pid for pid in ([payload.project_id] + list(payload.project_ids or [])) if pid}
+        allowed = set(ctx.project_ids or []) | set(ctx.member_project_ids or [])
+        if ctx.project_id:
+            allowed.add(ctx.project_id)
+        allowed_str = {str(pid) for pid in allowed if pid}
+        wanted = {str(pid) for pid in ([payload.project_id] + list(payload.project_ids or [])) if pid}
         if not wanted:
             raise ValidationError("برای افزودن استعلام، پروژه الزامی است")
-        if not wanted <= member:
+        if not wanted <= allowed_str:
             raise ForbiddenError("استعلام فقط برای پروژه‌های تخصیص‌یافته به شما مجاز است")
     quote = await quote_service.create_quote(db, payload, actor)
     return {"data": await serialize_quote_with_children(db, quote)}