fix: 多租户数据隔离P1a+P1b — 工作台/预警/行动计划/因果链按企业过滤

P1a(有entity表查询补齐):
- kpis get/update/delete/restore 跨企业404校验
- kpis create 强制entity=token企业, update禁止改归属
P1b(无entity表join隔离):
- alerts list/resolve join kpi_definitions 按企业过滤
- action_plans list join过滤 + create校验关联KPI归属
- kpi_causality full-network/list join过滤
- dashboard my_dashboard(用户发现) assigned/preset均按企业隔离
测试: 测试KPI种子entity对齐(2→1), pytest 451 passed
实证: 酣客token 6KPI(无博海id) vs 博海token 1KPI(414) 切换隔离正确

backend/app/api/alerts.py

@@ -2,8 +2,9 @@
 from fastapi import APIRouter, Depends, Query, HTTPException
 from sqlalchemy.orm import Session
 from app.database import get_db
+from app.deps import get_entity_id
 from app.auth_middleware import require_auth, require_role
-from app.models import KPIAlert, OperationLog, ActionPlan
+from app.models import KPIAlert, OperationLog, ActionPlan, KPIDefinition
 import logging
 
 logger = logging.getLogger("cma.alerts")
@@ -13,8 +14,9 @@ router = APIRouter(prefix="/api/cma/alerts", tags=["预警"],
 )
 
 @router.get("")
-def list_alerts(status: str = None, page: int = Query(1, ge=1), db: Session = Depends(get_db)):
-    query = db.query(KPIAlert)
+def list_alerts(status: str = None, page: int = Query(1, ge=1), db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
+    # 账套隔离: join kpi_definitions 按企业过滤 (2026-08-23 P1b)
+    query = db.query(KPIAlert).join(KPIDefinition, KPIDefinition.id == KPIAlert.kpi_id).filter(KPIDefinition.entity_id == entity_id)
     if status:
         query = query.filter(KPIAlert.status == status)
     total = query.count()
@@ -22,8 +24,9 @@ def list_alerts(status: str = None, page: int = Query(1, ge=1), db: Session = De
     return {"total": total, "data": [{c.name: getattr(a, c.name) for c in KPIAlert.__table__.columns} for a in alerts]}
 
 @router.post("/{alert_id}/resolve")
-def resolve_alert(alert_id: int, data: dict, db: Session = Depends(get_db)):
-    alert = db.query(KPIAlert).filter(KPIAlert.id == alert_id).first()
+def resolve_alert(alert_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
+    alert = db.query(KPIAlert).join(KPIDefinition, KPIDefinition.id == KPIAlert.kpi_id).filter(
+        KPIAlert.id == alert_id, KPIDefinition.entity_id == entity_id).first()
     if not alert:
         raise HTTPException(404, "预警不存在")
     alert.status = "resolved"