fix(security): ai_analysis多租户隔离缺口 + dashboard预警计数 + bot_kpis归属 + cost账套过滤 + kpis create白名单 (OpenCode审查20260907)

- ai_analysis: generate_rule_suggestions pending预警按entity过滤; kpi_analysis归属校验404;
  dashboard-analysis-stream/ask/review-plans 补 get_entity_id + KPI/ActionPlan/KPIAlert 全按账套过滤;
  stream cache key 含 entity_id (原跨企业串缓存)
- dashboard: summary alert_count 补 KPIAlert.entity_id 过滤 (kpi_total 已有)
- bot_kpis: update_bot_kpi_value 归属校验 404 (原任意登录可改他企 bot KPI)
- cost: ActualCost/StandardCost 确认多企业共用 → cost_overview/variance/breakdown/dashboard
  补 entity 过滤(engine 函数加 entity_id 透传); dashboard total_cost 既有 KeyError 修复
- kpis: create_kpi 字段白名单 (仿 UPDATE_KPI_WHITELIST+kpi_code), 拦截 status/important_flag 注入
- tests: 新增 test_multitenant_ai_20260907.py 11条越权用例 (跨entity 404/空返回断言)
- 全量 pytest: 745 passed / 10 failed(与基线 HEAD 一致, 存量问题非本次引入) / 1 xfailed

backend/app/api/bot_kpis.py

@@ -6,6 +6,7 @@ from datetime import datetime
 
 from app.database import get_db
 from app.auth_middleware import require_auth
+from app.deps import get_entity_id
 from app.models import KPIDefinition, KPIValue
 from app.risk_levels import risk_level
 
@@ -142,6 +143,7 @@ def update_bot_kpi_value(
     kpi_id: int,
     data: dict,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
     """更新Bot KPI当前值"""
     kpi = db.query(KPIDefinition).filter(
@@ -150,6 +152,9 @@ def update_bot_kpi_value(
     ).first()
     if not kpi:
         raise HTTPException(404, "Bot KPI不存在")
+    # 多租户隔离 2026-09-07: 归属校验，禁止跨企业修改他企 Bot KPI
+    if kpi.entity_id != entity_id:
+        raise HTTPException(404, "Bot KPI不存在")
 
     actual_value = data.get("actual_value")
     if actual_value is None: