fix: OpenCode审查16条修复 — 战略地图隔离/安全/逻辑漏洞

安全:
- ⑦ update_map 字段白名单(禁entity_id篡改, status限值域)
- ⑧ objectives 全端点补entity校验(原括号错位导致隔离失效) + update白名单
- ⑨ strategic_map_versions 加entity_id列+回填, list/snapshot/rollback过滤
- ⑩ get_map_review KPI查询加entity(同编码跨企业混入)
- ⑪ _sync_map_objectives 强制继承地图entity

逻辑:
- ③ MapCanvas 自动保存 currentMap.value 解包(30s自动保存修复)
- ④ 乐观锁字段 version_num→version 对齐
- ⑤ 红黄绿灯: 越低越好型反向 + 负值修正 + 月目标优先
- ⑥ review 补 action_plan_summary 字段

验证: 跨企业写目标404✓ entity_id注入被拒✓ pytest 531 passed✓

backend/app/models/__init__.py

@@ -262,6 +262,7 @@ class StrategicMapVersion(Base):
     """战略地图版本快照"""
     __tablename__ = "strategic_map_versions"
     id = Column(Integer, primary_key=True, index=True)
+    entity_id = Column(Integer, default=1, comment="企业ID (OpenCode审查#9 2026-08-26)")
     map_id = Column(Integer, ForeignKey("strategic_maps.id", ondelete="CASCADE"), nullable=False, comment="关联地图")
     version = Column(String(20), nullable=False, comment="版本号 v1.0 v1.1 ...")
     dimensions = Column(JSON, nullable=False, comment="维度数据快照")