feat(bot-tier): M1 Bot侧高危建议创建通道+目标值直写收口 (P0-②分层授权)

- 新增 POST /api/cma/bot/ai/suggestions (bot_suggestions.py, X-BOT-KEY鉴权, L2)
  高危建议(kpi_target/budget_adjust/action_plan) status恒unapplied 等人审批
  source白名单(bot/rule)防冒充manual; entity多租户归属校验; 幂等防重
- risk_levels.py: API_RISK_MAP加新端点 + 文件头补写操作语义分级low/high说明
- 收口: bot/kpis/create-with-links 拒绝直写非零target_value(显式置0, 考核基准=人拍板)
- test_risk_levels: L2计数5→6; 新增test_bot_suggestion_channel 12条(鉴权/语义/多租户/幂等/审批闭环/审计)

backend/app/api/bot_bridge.py

@@ -728,11 +728,26 @@ def bot_kpi_value_with_check(data: dict, db: Session = Depends(get_db), bot: dic
 @risk_level("L3")
 def bot_kpi_create_with_links(data: dict, db: Session = Depends(get_db), bot: dict = Depends(verify_bot_key)):
     """聚合B: 创建KPI + 关联战略地图 + 批量因果链（Agent建KPI标准动作）
-    body: {kpi_code, kpi_name, dimension, entity_id?, target_value?, unit?, link_map_id?, link_causality?}"""
+    body: {kpi_code, kpi_name, dimension, entity_id?, unit?, link_map_id?, link_causality?}
+
+    分层授权收口（2026-09-03 P0-②）: Bot 创建KPI不得携带自定目标值——
+    考核基准类（目标值）= 人拍板；target_value 一律显式置 0（满足治理必填，
+    后续由人工设定或走 POST /api/cma/bot/ai/suggestions 建议通道待审批）。
+    """
     entity_id = int(data.get("entity_id") or 1)
     from app.api.kpis import _validate_kpi_data, apply_calc_type_inference
     kpi_data = {k: v for k, v in data.items() if k not in ("entity_id", "link_map_id", "link_causality")}
 
+    # 收口: 非零 target_value 直接拒绝（不静默丢弃，让调用方明确知晓规则）
+    tv_raw = data.get("target_value")
+    if tv_raw not in (None, 0, "0", 0.0):
+        raise HTTPException(
+            400,
+            "Bot创建KPI不允许直写目标值（考核基准类=人拍板，2026-09-03分层授权）。"
+            "请省略 target_value（自动置0，人工后续设定）或改走 POST /api/cma/bot/ai/suggestions 建议通道待审批。",
+        )
+    kpi_data["target_value"] = 0  # 显式置0（覆盖 0/"0"/None 三种传入）
+
     # ① 创建KPI（编码唯一 + 治理校验 + 强制企业）
     code = kpi_data.get("kpi_code", "")
     if not code: