fix(cma): scope ai-suggestion dismiss and target KPI to session entity

dismiss_suggestion: add get_entity_id dependency and filter AISuggestion.entity_id (cross-entity dismiss returned 200 and mutated the foreign row).

_apply_kpi_target/_apply_budget_adjust: constrain target KPIDefinition lookup to sug.entity_id so suggestion_data pointing at a foreign KPI yields 404 instead of rewriting it.

Regression: backend/tests/test_dismiss_suggestion_entity_scope_20260918.py (RED 3 failed before, GREEN 5 passed after; full suite 1220 -> 1225 passed, 1 xfailed).

backend/app/api/ai_suggestions.py

@@ -118,7 +118,10 @@ def _apply_kpi_target(db: Session, sug: AISuggestion, params: dict, current_user
     kpi_id = params.get("kpi_id") or sug.target_id
     if not kpi_id:
         raise HTTPException(400, "缺少 kpi_id")
-    kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
+    kpi = db.query(KPIDefinition).filter(
+        KPIDefinition.id == kpi_id,
+        KPIDefinition.entity_id == sug.entity_id,   # 2026-09-18 派生单: 目标KPI须归属建议账套
+    ).first()
     if not kpi:
         raise HTTPException(404, f"KPI {kpi_id} 不存在")
     before = kpi.target_value
@@ -157,7 +160,10 @@ def _apply_budget_adjust(db: Session, sug: AISuggestion, params: dict, current_u
     kpi_id = params.get("kpi_id") or sug.target_id
     if not kpi_id:
         raise HTTPException(400, "缺少 kpi_id")
-    kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
+    kpi = db.query(KPIDefinition).filter(
+        KPIDefinition.id == kpi_id,
+        KPIDefinition.entity_id == sug.entity_id,   # 2026-09-18 派生单: 目标KPI须归属建议账套
+    ).first()
     if not kpi:
         raise HTTPException(404, f"KPI {kpi_id} 不存在")
 
@@ -397,10 +403,14 @@ def apply_suggestion(
 def dismiss_suggestion(
     suggestion_id: int,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
     current_user=Depends(require_auth),
 ):
     """忽略建议"""
-    sug = db.query(AISuggestion).filter(AISuggestion.id == suggestion_id).first()
+    sug = db.query(AISuggestion).filter(
+        AISuggestion.id == suggestion_id,
+        AISuggestion.entity_id == entity_id,   # 2026-09-18 派生单: 建议须归属会话账套
+    ).first()
     if not sug:
         raise HTTPException(404, "建议不存在")
     sug.status = "dismissed"