fix: OpenCode审查16条修复 — 战略地图隔离/安全/逻辑漏洞

安全:
- ⑦ update_map 字段白名单(禁entity_id篡改, status限值域)
- ⑧ objectives 全端点补entity校验(原括号错位导致隔离失效) + update白名单
- ⑨ strategic_map_versions 加entity_id列+回填, list/snapshot/rollback过滤
- ⑩ get_map_review KPI查询加entity(同编码跨企业混入)
- ⑪ _sync_map_objectives 强制继承地图entity

逻辑:
- ③ MapCanvas 自动保存 currentMap.value 解包(30s自动保存修复)
- ④ 乐观锁字段 version_num→version 对齐
- ⑤ 红黄绿灯: 越低越好型反向 + 负值修正 + 月目标优先
- ⑥ review 补 action_plan_summary 字段

验证: 跨企业写目标404✓ entity_id注入被拒✓ pytest 531 passed✓

frontend/src/views/MapCanvas.vue

@@ -784,7 +784,7 @@ async function saveCanvas(silent?: boolean) {
     await mapApi.update(selectedMap.value, {
       dimensions: mapData,
       canvas_data: { connections: connections.value },
-      version_num: currentMap.value?.version_num,
+      version: currentMap.value?.version,
     })
     markClean()
     if (!silent) ElMessage.success("已保存")
@@ -1017,7 +1017,7 @@ onMounted(async () => {
   }
   // 自动保存：每30秒自动保存草稿
   autoSaveTimer = setInterval(() => {
-    if (currentMap?.status === 'draft') saveCanvas(true)
+    if (currentMap.value?.status === 'draft') saveCanvas(true)
   }, 30000)
   window.addEventListener('resize', triggerRecalc)
 })