fix: 多租户数据隔离P1a+P1b — 工作台/预警/行动计划/因果链按企业过滤

P1a(有entity表查询补齐):
- kpis get/update/delete/restore 跨企业404校验
- kpis create 强制entity=token企业, update禁止改归属
P1b(无entity表join隔离):
- alerts list/resolve join kpi_definitions 按企业过滤
- action_plans list join过滤 + create校验关联KPI归属
- kpi_causality full-network/list join过滤
- dashboard my_dashboard(用户发现) assigned/preset均按企业隔离
测试: 测试KPI种子entity对齐(2→1), pytest 451 passed
实证: 酣客token 6KPI(无博海id) vs 博海token 1KPI(414) 切换隔离正确

backend/app/api/dashboard.py

@@ -390,8 +390,9 @@ def predict_kpis(db: Session = Depends(get_db), entity_id: int = Depends(get_ent
 def my_dashboard(
     current_user: User = Depends(require_auth),
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """个人工作台：返回我的KPI、改善行动、待办提醒"""
+    """个人工作台：返回我的KPI、改善行动、待办提醒（账套隔离: 按token企业过滤）"""
     username = current_user.username
     name = current_user.name
     role = current_user.role
@@ -405,22 +406,24 @@ def my_dashboard(
     }
     preset_codes = ROLE_PRESET_KPIS.get(role, [])
 
-    # 1. 我的KPI（responsible_user匹配用户名或姓名）+ 角色预设
+    # 1. 我的KPI（responsible_user匹配用户名或姓名）+ 角色预设（均按企业隔离）
     assigned_kpis = db.query(KPIDefinition).filter(
         or_(
             KPIDefinition.responsible_user == username,
             KPIDefinition.responsible_user == name,
         ),
         KPIDefinition.status == "active",
+        KPIDefinition.entity_id == entity_id,
     ).all()
     assigned_ids = {k.id for k in assigned_kpis}
 
-    # 补充角色预设KPI（去重）
+    # 补充角色预设KPI（去重，按企业隔离）
     preset_kpis = []
     if preset_codes:
         q = db.query(KPIDefinition).filter(
             KPIDefinition.kpi_code.in_(preset_codes),
             KPIDefinition.status == "active",
+            KPIDefinition.entity_id == entity_id,
         )
         if assigned_ids:
             q = q.filter(~KPIDefinition.id.in_(assigned_ids))