fix: 多租户数据隔离P1a+P1b — 工作台/预警/行动计划/因果链按企业过滤

P1a(有entity表查询补齐):
- kpis get/update/delete/restore 跨企业404校验
- kpis create 强制entity=token企业, update禁止改归属
P1b(无entity表join隔离):
- alerts list/resolve join kpi_definitions 按企业过滤
- action_plans list join过滤 + create校验关联KPI归属
- kpi_causality full-network/list join过滤
- dashboard my_dashboard(用户发现) assigned/preset均按企业隔离
测试: 测试KPI种子entity对齐(2→1), pytest 451 passed
实证: 酣客token 6KPI(无博海id) vs 博海token 1KPI(414) 切换隔离正确

backend/app/api/kpi_causality.py

@@ -8,6 +8,7 @@ from typing import Optional
 import logging
 
 from app.database import get_db
+from app.deps import get_entity_id
 from app.auth_middleware import require_auth, require_role
 from app.models import KPIDefinition, KPICausality, KPIValue, OperationLog
 
@@ -28,9 +29,9 @@ def _to_dict(obj):
 # ============================================================
 
 @router.get("/full-network")
-def get_full_network(db: Session = Depends(get_db)):
-    """获取全局因果网络数据（用于力导向图）"""
-    edges = db.query(KPICausality).all()
+def get_full_network(db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
+    """获取全局因果网络数据（用于力导向图）— 账套隔离: 仅当前企业KPI的因果链 (2026-08-23 P1b)"""
+    edges = db.query(KPICausality).join(KPIDefinition, KPIDefinition.id == KPICausality.source_kpi_id).filter(KPIDefinition.entity_id == entity_id).all()
     node_ids = set()
     edge_list = []
     for e in edges:
@@ -212,9 +213,10 @@ def list_causalities(
     source_kpi_id: Optional[int] = None,
     target_kpi_id: Optional[int] = None,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """获取因果链列表"""
-    query = db.query(KPICausality)
+    """获取因果链列表（账套隔离: 仅当前企业KPI, 2026-08-23 P1b）"""
+    query = db.query(KPICausality).join(KPIDefinition, KPIDefinition.id == KPICausality.source_kpi_id).filter(KPIDefinition.entity_id == entity_id)
     if source_kpi_id:
         query = query.filter(KPICausality.source_kpi_id == source_kpi_id)
     if target_kpi_id: