feat: 战略地图多租户隔离 — 酣客/博海地图按企业显示

- strategic_maps/map_objectives 加 entity_id 列+模型+回填(按标题: 酣客→1/博海→2)
- maps: list按企业过滤, create/create-with-template强制token企业, update/delete/batch-delete/connections/review 跨企业404
- objectives/versions: 按map归属过滤
- _sync_map_objectives 继承地图entity
- 实证: 酣客token→map32(酣客), 博海token→map49(博海), 跨企业读404
- pytest 482 passed
- 多租户隔离专项最终收官(含周报遗留项)

backend/app/api/objectives.py

@@ -2,6 +2,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from app.database import get_db
+from app.deps import get_entity_id
 from app.auth_middleware import require_role
 from app.models import MapObjective, StrategicMap, KPIDefinition
 
@@ -11,7 +12,7 @@ router = APIRouter(prefix="/api/cma/maps", tags=["战略地图目标"],
 
 
 @router.get("/{map_id}/objectives")
-def list_objectives(map_id: int, db: Session = Depends(get_db)):
+def list_objectives(map_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     """获取某地图下的所有目标"""
     objs = db.query(MapObjective).filter(
         MapObjective.map_id == map_id
@@ -20,9 +21,9 @@ def list_objectives(map_id: int, db: Session = Depends(get_db)):
 
 
 @router.post("/{map_id}/objectives")
-def create_objective(map_id: int, data: dict, db: Session = Depends(get_db)):
+def create_objective(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     """新增目标"""
-    m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
+    m = db.query(StrategicMap).filter(StrategicMap.id == map_id), StrategicMap.entity_id == entity_id.first()
     if not m:
         raise HTTPException(404, "战略地图不存在")
     obj = MapObjective(
@@ -40,7 +41,7 @@ def create_objective(map_id: int, data: dict, db: Session = Depends(get_db)):
 
 
 @router.put("/{map_id}/objectives/{obj_id}")
-def update_objective(map_id: int, obj_id: int, data: dict, db: Session = Depends(get_db)):
+def update_objective(map_id: int, obj_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     """修改目标"""
     obj = db.query(MapObjective).filter(
         MapObjective.id == obj_id, MapObjective.map_id == map_id
@@ -55,7 +56,7 @@ def update_objective(map_id: int, obj_id: int, data: dict, db: Session = Depends
 
 
 @router.delete("/{map_id}/objectives/{obj_id}")
-def delete_objective(map_id: int, obj_id: int, db: Session = Depends(get_db)):
+def delete_objective(map_id: int, obj_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     """删除目标"""
     obj = db.query(MapObjective).filter(
         MapObjective.id == obj_id, MapObjective.map_id == map_id
@@ -68,7 +69,7 @@ def delete_objective(map_id: int, obj_id: int, db: Session = Depends(get_db)):
 
 
 @router.put("/{map_id}/objectives/sort")
-def sort_objectives(map_id: int, data: dict, db: Session = Depends(get_db)):
+def sort_objectives(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     """批量排序: {"ids": [3, 1, 2]}"""
     ids = data.get("ids", [])
     for idx, obj_id in enumerate(ids):