fix: 多租户数据隔离P1a+P1b — 工作台/预警/行动计划/因果链按企业过滤

P1a(有entity表查询补齐):
- kpis get/update/delete/restore 跨企业404校验
- kpis create 强制entity=token企业, update禁止改归属
P1b(无entity表join隔离):
- alerts list/resolve join kpi_definitions 按企业过滤
- action_plans list join过滤 + create校验关联KPI归属
- kpi_causality full-network/list join过滤
- dashboard my_dashboard(用户发现) assigned/preset均按企业隔离
测试: 测试KPI种子entity对齐(2→1), pytest 451 passed
实证: 酣客token 6KPI(无博海id) vs 博海token 1KPI(414) 切换隔离正确

backend/app/api/action_plans.py

@@ -7,6 +7,7 @@ import re
 import logging
 from calendar import monthrange
 from app.database import get_db
+from app.deps import get_entity_id
 from app.auth_middleware import require_role, require_auth
 from app.models import ActionPlan, KPIAlert, KPIDefinition, User, Objective
 
@@ -88,9 +89,10 @@ def list_plans(
     alert_id: Optional[int] = None,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_auth),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """获取行动计划列表"""
-    query = db.query(ActionPlan).order_by(ActionPlan.created_at.desc())
+    """获取行动计划列表（账套隔离: join KPI按企业过滤, 2026-08-23 P1b）"""
+    query = db.query(ActionPlan).join(KPIDefinition, KPIDefinition.id == ActionPlan.kpi_id).filter(KPIDefinition.entity_id == entity_id).order_by(ActionPlan.created_at.desc())
 
     if status:
         query = query.filter(ActionPlan.status == status)
@@ -123,12 +125,17 @@ def create_plan(
     data: dict,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_auth),
+    entity_id: int = Depends(get_entity_id),
 ):
     """创建改善行动计划（也是OKR的KR）"""
     required = ["title", "kpi_id"]
     for field in required:
         if field not in data:
             raise HTTPException(400, f"缺少必填字段: {field}")
+    # 账套隔离: 关联KPI必须属于当前企业 (2026-08-23 P1b)
+    kpi_ent = db.query(KPIDefinition).filter(KPIDefinition.id == data["kpi_id"]).first()
+    if not kpi_ent or kpi_ent.entity_id != entity_id:
+        raise HTTPException(404, "关联KPI不存在")
 
     due_date = datetime.fromisoformat(data["due_date"]) if data.get("due_date") else None