fix: allow project admins to create and manage project-scoped custom fields

[10done]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Closes #7424

##Issue Description
When a user with Project Administrator role (non-org-admin) created a project-scoped custom field via Project Settings → Custom Fields, the save flow partially failed:

1. POST /api/v1/metadata/fields/ → 201 (MetadataField created)
2. POST /api/v1/organisations/{id}/metadata-model-fields/ → 403 (binding fails, field left orphaned)

Root cause: MetadataModelFieldPermissions only checked is_organisation_admin for create, update, and destroy actions. MetadataFieldPermissions already had the correct project-admin path, but its sibling class did not.

Fix: Extended MetadataModelFieldPermissions in api/metadata/permissions.py to allow project admins to create, update, and delete MetadataModelField bindings for project-scoped fields. Org-scoped fields remain restricted to org admins only.

How did you test this code?

Reproduced the bug via direct API calls as a project-admin user (org role = USER, project admin = true):

Before fix:

• POST /api/v1/organisations/1/metadata-model-fields/ → 403{"detail": "You do not have permission to perform this action."}`

After fix:

• POST /api/v1/organisations/1/metadata-model-fields/ → 201{"id": 2, "field": 2, "content_type": 55, "is_required_for": []}`

**Regression tests added **

• Project admin can bind a project-scoped field to a content type (the bug case)
• Project admin cannot bind an org-scoped field (security boundary)
• Project admin can update/delete bindings for their own project's fields
• Project admin cannot update/delete bindings for other projects' or org-scoped fields

Since I cannot access the Enterprise plan I tried to fix it via the API calls. I hope it fixes the issue.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[vercel]

@10done is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[10done]

@khvn26 Can you please review whenever you get time. Thank you.

[matthewelwell]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the metadata permissions in api/metadata/permissions.py to allow project administrators to create, update, and delete project-scoped metadata fields. It also adds comprehensive unit tests in api/tests/unit/metadata/test_views.py to verify these permission rules under various scenarios. I have no feedback to provide as there are no review comments to evaluate.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.40%. Comparing base (70f25fa) to head (47c0aa9).
⚠️ Report is 58 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7518      +/-   ##
==========================================
- Coverage   98.46%   98.40%   -0.07%     
==========================================
  Files        1398     1398              
  Lines       52900    52811      -89     
==========================================
- Hits        52090    51968     -122     
- Misses        810      843      +33     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[matthewelwell]

Thanks very much for the contribution @10done. On the whole, this looks great. I've added a few comments that need addressing, but only minor things really.

[10done]

@matthewelwell Thank you for the review on the PR. I have made the changes as suggested and also removed the local imports on other tests too.