feat: 多租户隔离P2批1 — OKR域+kpi_values加entity_id列

- 模型: Objective/KR/ObjectiveKPI/KPIValue 加 entity_id
- DB: 4表加列; kpi_values 1610条按kpi_id回填(1269酣客/341博海)
- OKR域: 测试O删除重建; okr list/get/create + ontology trace/objectives 按token企业隔离(跨企业404)
- KPIValue写入: data/bot_bridge/bot_kpis 创建时带entity_id
- 验证: 酣客创建OKR博海不可见; 跨企业读404; pytest 451通过(expenses单跑37通过为既有排序flaky)

backend/app/api/ontology.py

@@ -10,6 +10,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 from typing import Optional
 from app.database import get_db
+from app.deps import get_entity_id
 from app.auth_middleware import require_role
 from app.models import Objective, KPIDefinition, ObjectiveKPI, KPISubjectMap, KR, Subject
 
@@ -27,9 +28,10 @@ def _num(v):
 def trace_ontology(
     objective_id: int = Query(..., description="OKR目标ID, 从O→KPI→科目逐层追溯"),
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """本体追溯链: O(目标) → KPI(指标) → 科目(数据)"""
-    obj = db.query(Objective).filter(Objective.id == objective_id).first()
+    """本体追溯链: O(目标) → KPI(指标) → 科目(数据) — 账套隔离 (2026-08-23 P2)"""
+    obj = db.query(Objective).filter(Objective.id == objective_id, Objective.entity_id == entity_id).first()
     if not obj:
         raise HTTPException(404, "目标不存在")
 
@@ -122,9 +124,10 @@ def trace_ontology(
 def list_ontology_objectives(
     quarter: Optional[str] = Query(None, description="筛选季度: 2026Q3"),
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """所有OKR目标的三层链路概览(前端OKR页用)"""
-    q = db.query(Objective)
+    """所有OKR目标的三层链路概览(前端OKR页用) — 账套隔离 (2026-08-23 P2)"""
+    q = db.query(Objective).filter(Objective.entity_id == entity_id)
     if quarter:
         q = q.filter(Objective.quarter == quarter)
     objs = q.order_by(Objective.quarter.desc(), Objective.id).all()