fix(cma): entity isolation batch4 (cash plan writes, budget ownership, read leaks, okr template)

P0-A cash.py: scope api_update_plan / api_delete_plan / api_complete_plan /
api_register_payment to session entity (cross-entity id -> 404, aligning with
the file's existing get_entity_id endpoints).
P0-B budget.py: write entity_id on BudgetPlan creation + require the KPI to
belong to the session entity; scope /comparison, /comparison/kpi/{id} and
/deviation-report reads to the session entity.
P1 notifications.py: explicit field whitelist (name/config/enabled) on
update_channel to close mass-assignment.
P1 read leaks scoped to session entity: bot_kpis list, data_quality check/stats
(KPI calibre only; quality-log table has no entity_id column), kpis causality
chain + associate-map (KPI and map ownership), dashboard my-kpis,
customer_dashboard list, kpi_governance audit, budget_generate candidates,
driver_budget history (+ entity_id on its write path), expenses stats
(+ entity_id on its write path).
P2 okr_templates.py: write entity_id on the StrategicMap created by apply.

tests: tests/test_cross_entity_isolation_batch4_20260921.py (30 cases;
RED before fix = 22 failed, GREEN after = 30 passed; full suite 1302 passed /
1 xfailed / 0 failed).

backend/app/api/kpis.py

@@ -437,9 +437,13 @@ def get_kpi_causality_chain(
     kpi_id: int,
     db: Session = Depends(get_db),
     current_user = Depends(require_auth),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """KPI因果链追踪 — 返回单个KPI的上下游因果链"""
-    kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
+    """KPI因果链追踪 — 返回单个KPI的上下游因果链（账套隔离 2026-09-21：跨账套 id → 404）"""
+    kpi = db.query(KPIDefinition).filter(
+        KPIDefinition.id == kpi_id,
+        KPIDefinition.entity_id == entity_id,
+    ).first()
     if not kpi:
         raise HTTPException(404, "KPI不存在")
 
@@ -884,14 +888,21 @@ def kpi_to_dict(k):
 
 
 @router.put("/{kpi_id}/associate-map")
-def associate_kpi_map(kpi_id: int, data: dict, db: Session = Depends(get_db), user=WRITE_ROLES):
-    """关联KPI到战略地图"""
-    kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
+def associate_kpi_map(kpi_id: int, data: dict, db: Session = Depends(get_db), user=WRITE_ROLES,
+                      entity_id: int = Depends(get_entity_id)):
+    """关联KPI到战略地图（账套隔离 2026-09-21：KPI 与地图均须属本账套，跨账套 → 404）"""
+    kpi = db.query(KPIDefinition).filter(
+        KPIDefinition.id == kpi_id,
+        KPIDefinition.entity_id == entity_id,
+    ).first()
     if not kpi:
         raise HTTPException(404, "KPI不存在")
     map_id = data.get("map_id")
     if map_id is not None:
-        m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
+        m = db.query(StrategicMap).filter(
+            StrategicMap.id == map_id,
+            StrategicMap.entity_id == entity_id,
+        ).first()
         if not m:
             raise HTTPException(404, "战略地图不存在")
     kpi.map_id = map_id