fix: 多租户数据隔离P1a+P1b — 工作台/预警/行动计划/因果链按企业过滤

P1a(有entity表查询补齐):
- kpis get/update/delete/restore 跨企业404校验
- kpis create 强制entity=token企业, update禁止改归属
P1b(无entity表join隔离):
- alerts list/resolve join kpi_definitions 按企业过滤
- action_plans list join过滤 + create校验关联KPI归属
- kpi_causality full-network/list join过滤
- dashboard my_dashboard(用户发现) assigned/preset均按企业隔离
测试: 测试KPI种子entity对齐(2→1), pytest 451 passed
实证: 酣客token 6KPI(无博海id) vs 博海token 1KPI(414) 切换隔离正确

backend/app/api/kpis.py

@@ -475,10 +475,13 @@ def get_kpi_causality_chain(
 # ============================================================
 
 @router.get("/{kpi_id}")
-def get_kpi(kpi_id: int, db: Session = Depends(get_db)):
+def get_kpi(kpi_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
     if not kpi:
         raise HTTPException(404, "KPI不存在")
+    # 账套隔离: 禁止跨企业读取 (2026-08-23 P1a)
+    if kpi.entity_id != entity_id:
+        raise HTTPException(404, "KPI不存在")
     return kpi_to_dict(kpi)
 
 
@@ -586,15 +589,16 @@ def apply_calc_type_inference(data: dict, infer_missing: bool = True) -> dict:
 
 
 @router.post("")
-def create_kpi(data: dict, db: Session = Depends(get_db), user=WRITE_ROLES):
+def create_kpi(data: dict, db: Session = Depends(get_db), user=WRITE_ROLES, entity_id: int = Depends(get_entity_id)):
     # 检查编码唯一性
-    existing = db.query(KPIDefinition).filter(KPIDefinition.kpi_code == data.get("kpi_code", "")).first()
+    existing = db.query(KPIDefinition).filter(KPIDefinition.kpi_code == data.get("kpi_code", ""), KPIDefinition.entity_id == entity_id).first()
     if existing:
         raise HTTPException(400, f"KPI编码 {data['kpi_code']} 已存在")
     # 数据治理校验（规则1强制拦截）
     errs = _validate_kpi_data(data, db=db, is_update=False)
     if errs:
         raise HTTPException(422, detail={"message": "数据校验不通过", "errors": errs})
+    data["entity_id"] = entity_id  # 账套隔离: 强制写入token企业 (2026-08-23 P1a)
     data = apply_calc_type_inference(data)
     kpi = KPIDefinition(**data)
     db.add(kpi)
@@ -605,14 +609,18 @@ def create_kpi(data: dict, db: Session = Depends(get_db), user=WRITE_ROLES):
 
 
 @router.put("/{kpi_id}")
-def update_kpi(kpi_id: int, data: dict, db: Session = Depends(get_db), user=WRITE_ROLES):
+def update_kpi(kpi_id: int, data: dict, db: Session = Depends(get_db), user=WRITE_ROLES, entity_id: int = Depends(get_entity_id)):
     kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
     if not kpi:
         raise HTTPException(404, "KPI不存在")
+    # 账套隔离: 禁止跨企业修改 (2026-08-23 P1a)
+    if kpi.entity_id != entity_id:
+        raise HTTPException(404, "KPI不存在")
     # 数据治理校验（更新时只检查传了但为空的字段）
     errs = _validate_kpi_data(data, db=db, current_kpi_id=kpi_id, is_update=True)
     if errs:
         raise HTTPException(422, detail={"message": "数据校验不通过", "errors": errs})
+    data.pop("entity_id", None)  # 禁止通过update改企业归属
     data = apply_calc_type_inference(data, infer_missing=False)
     for k, v in data.items():
         if hasattr(kpi, k) and v is not None:
@@ -623,18 +631,24 @@ def update_kpi(kpi_id: int, data: dict, db: Session = Depends(get_db), user=WRIT
 
 
 @router.delete("/{kpi_id}")
-def delete_kpi(kpi_id: int, db: Session = Depends(get_db), user=WRITE_ROLES):
+def delete_kpi(kpi_id: int, db: Session = Depends(get_db), user=WRITE_ROLES, entity_id: int = Depends(get_entity_id)):
     kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
     if kpi:
+        # 账套隔离: 禁止跨企业删除 (2026-08-23 P1a)
+        if kpi.entity_id != entity_id:
+            raise HTTPException(404, "KPI不存在")
         kpi.status = "disabled"
         db.commit()
     return {"message": "已删除"}
 
 
 @router.put("/{kpi_id}/restore")
-def restore_kpi(kpi_id: int, db: Session = Depends(get_db), user=WRITE_ROLES):
+def restore_kpi(kpi_id: int, db: Session = Depends(get_db), user=WRITE_ROLES, entity_id: int = Depends(get_entity_id)):
     kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
     if kpi:
+        # 账套隔离: 禁止跨企业恢复 (2026-08-23 P1a)
+        if kpi.entity_id != entity_id:
+            raise HTTPException(404, "KPI不存在")
         kpi.status = "active"
         db.commit()
     return {"message": "已恢复"}