fix(auth): unknown project role denies instead of KeyError 500

check_permission now returns False for roles not in _ROLE_LEVEL
(e.g. a directly-written 'member' row, which set_member itself
rejects but legacy/direct DB rows can still carry), so the failure
mode is PermissionError/403, never an unhandled 500. Regression test
test_unknown_role_denied_not_500 fails with KeyError on old code.

cloud/auth.py

@@ -334,7 +334,13 @@ class AuthStore:
         role = self._member_role(project_id, user_id)
         if role is None:
             return False
-        return _ROLE_LEVEL[role] >= _ROLE_LEVEL[min_role]
+        # 未知角色（如直接写库留下的 'member'）一律按无权限处理，
+        # 绝不能 KeyError 冒泡成 500：权限检查的失败语义只能是
+        # False / PermissionError，绝不是服务端异常。
+        level = _ROLE_LEVEL.get(role)
+        if level is None:
+            return False
+        return level >= _ROLE_LEVEL[min_role]
 
     def require_permission(self, user_id, project_id, action):
         """不满足权限时 raise PermissionError。"""