feat: 战略地图多租户隔离 — 酣客/博海地图按企业显示

- strategic_maps/map_objectives 加 entity_id 列+模型+回填(按标题: 酣客→1/博海→2)
- maps: list按企业过滤, create/create-with-template强制token企业, update/delete/batch-delete/connections/review 跨企业404
- objectives/versions: 按map归属过滤
- _sync_map_objectives 继承地图entity
- 实证: 酣客token→map32(酣客), 博海token→map49(博海), 跨企业读404
- pytest 482 passed
- 多租户隔离专项最终收官(含周报遗留项)

backend/app/api/versions.py

@@ -2,6 +2,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from app.database import get_db
+from app.deps import get_entity_id
 from app.auth_middleware import require_role
 from app.models import StrategicMap, StrategicMapVersion
 
@@ -11,7 +12,7 @@ router = APIRouter(prefix="/api/cma/maps", tags=["战略地图版本"],
 
 
 @router.get("/{map_id}/versions")
-def list_versions(map_id: int, db: Session = Depends(get_db)):
+def list_versions(map_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     """查看版本历史"""
     versions = db.query(StrategicMapVersion).filter(
         StrategicMapVersion.map_id == map_id
@@ -20,9 +21,9 @@ def list_versions(map_id: int, db: Session = Depends(get_db)):
 
 
 @router.post("/{map_id}/versions/snapshot")
-def create_snapshot(map_id: int, data: dict, db: Session = Depends(get_db)):
+def create_snapshot(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     """手动创建快照"""
-    m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
+    m = db.query(StrategicMap).filter(StrategicMap.id == map_id), StrategicMap.entity_id == entity_id.first()
     if not m:
         raise HTTPException(404, "战略地图不存在")
 
@@ -61,7 +62,7 @@ def create_snapshot(map_id: int, data: dict, db: Session = Depends(get_db)):
 
 
 @router.post("/{map_id}/versions/{ver_id}/rollback")
-def rollback_version(map_id: int, ver_id: int, db: Session = Depends(get_db)):
+def rollback_version(map_id: int, ver_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
     """回滚到指定版本"""
     m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
     if not m: