feat(bot-tier): M1 Bot侧高危建议创建通道+目标值直写收口 (P0-②分层授权)

- 新增 POST /api/cma/bot/ai/suggestions (bot_suggestions.py, X-BOT-KEY鉴权, L2)
  高危建议(kpi_target/budget_adjust/action_plan) status恒unapplied 等人审批
  source白名单(bot/rule)防冒充manual; entity多租户归属校验; 幂等防重
- risk_levels.py: API_RISK_MAP加新端点 + 文件头补写操作语义分级low/high说明
- 收口: bot/kpis/create-with-links 拒绝直写非零target_value(显式置0, 考核基准=人拍板)
- test_risk_levels: L2计数5→6; 新增test_bot_suggestion_channel 12条(鉴权/语义/多租户/幂等/审批闭环/审计)

backend/tests/test_risk_levels.py

@@ -49,11 +49,11 @@ class TestRiskMapCoverage:
         assert not unlabeled, f"以下路由函数缺少 @risk_level 装饰器: {unlabeled}"
 
     def test_risk_level_counts(self):
-        """分级统计与方案一致：L1=21(20项清单+risk-levels端点)、L2=5(4项清单+okr/create)、L3=3、L4=0"""
+        """分级统计与方案一致：L1=21(20项清单+risk-levels端点)、L2=6(4项清单+okr/create+bot建议通道)、L3=3、L4=0"""
         from collections import Counter
         counts = Counter(API_RISK_MAP.values())
         assert counts["L1"] == 21, counts
-        assert counts["L2"] == 5, counts
+        assert counts["L2"] == 6, counts
         assert counts["L3"] == 3, counts
         assert counts["L4"] == 0, "Bot API面不得存在L4端点（安全底线）"
 
@@ -94,7 +94,7 @@ class TestRiskLevelsEndpoint:
 
         # 分级统计
         assert data["summary"]["L1"] == 21
-        assert data["summary"]["L2"] == 5
+        assert data["summary"]["L2"] == 6
         assert data["summary"]["L3"] == 3
         assert data["summary"]["L4"] == 0