fix(security): 多租户隔离全量修复 security-fix multi-tenant (OpenCode审查P0)

- bot_bridge 18数据端点全部 entity_id 隔离（Depends(get_entity_id)/body），/ping /risk-levels 豁免
- alert_rules 11端点 entity_id 隔离 + KPIAlert/DynamicThresholdCache 写入 entity_id
- reports 17端点隔离 + generate_report 写 ReportHistory.entity_id + history 按 entity 过滤
- ai_analysis 移除硬编码默认key，改 _require_deepseek_key() 强制 env 缺失 503
- budget auto-decompose 硬编码 entity_id==1 改请求 entity
- kpis update_kpi 加 UPDATE_KPI_WHITELIST 白名单（status/important_flag 不可越权改）
- data_quality 收敛：删 MySQL JSON 版 _run_rule_checks，check-governance 复用 _run_governance_checks（SQLite 兼容）
- _eval_threshold invert 参数修复（>=↔< 等取反），red 分支不传 invert 保持行为
- 新增 test_security_multitenant.py 13条（bot_bridge/alert_rules/reports 隔离 + invert + SQLite governance）
- models 6表加 entity_id 列；生产库已 ALTER + 按真实归属回填（kpi_alerts 472行中216行属entity≠1）

backend/app/api/ai_analysis.py

@@ -232,9 +232,17 @@ def _unapplied_suggestions(db: Session, entity_id: int, limit: int = 20) -> list
     return [_sug_dict(s) for s in items]
 
 
+def _require_deepseek_key() -> str:
+    """强制从环境变量读取 DeepSeek Key，禁止硬编码默认值（安全修复 2026-08-31）"""
+    api_key = os.getenv("DEEPSEEK_API_KEY")
+    if not api_key:
+        raise HTTPException(503, "DEEPSEEK_API_KEY 未配置（禁止硬编码默认key，安全修复 2026-08-31）")
+    return api_key
+
+
 async def _call_deepseek(prompt: str) -> str:
     """调用DeepSeek API"""
-    api_key = os.getenv("DEEPSEEK_API_KEY", "sk-8e24e6eb87f2475e96ea0980002dc2e8")
+    api_key = _require_deepseek_key()
     async with httpx.AsyncClient(timeout=30) as client:
         resp = await client.post(
             "https://api.deepseek.com/v1/chat/completions",
@@ -383,7 +391,7 @@ async def _stream_analysis(prompt: str):
             "POST",
             "https://api.deepseek.com/v1/chat/completions",
             headers={
-                "Authorization": f"Bearer {os.getenv('DEEPSEEK_API_KEY', 'sk-8e24e6eb87f2475e96ea0980002dc2e8')}",
+                "Authorization": f"Bearer {_require_deepseek_key()}",
                 "Content-Type": "application/json",
             },
             json={