fix(security): ai_analysis多租户隔离缺口 + dashboard预警计数 + bot_kpis归属 + cost账套过滤 + kpis create白名单 (OpenCode审查20260907)

- ai_analysis: generate_rule_suggestions pending预警按entity过滤; kpi_analysis归属校验404;
  dashboard-analysis-stream/ask/review-plans 补 get_entity_id + KPI/ActionPlan/KPIAlert 全按账套过滤;
  stream cache key 含 entity_id (原跨企业串缓存)
- dashboard: summary alert_count 补 KPIAlert.entity_id 过滤 (kpi_total 已有)
- bot_kpis: update_bot_kpi_value 归属校验 404 (原任意登录可改他企 bot KPI)
- cost: ActualCost/StandardCost 确认多企业共用 → cost_overview/variance/breakdown/dashboard
  补 entity 过滤(engine 函数加 entity_id 透传); dashboard total_cost 既有 KeyError 修复
- kpis: create_kpi 字段白名单 (仿 UPDATE_KPI_WHITELIST+kpi_code), 拦截 status/important_flag 注入
- tests: 新增 test_multitenant_ai_20260907.py 11条越权用例 (跨entity 404/空返回断言)
- 全量 pytest: 745 passed / 10 failed(与基线 HEAD 一致, 存量问题非本次引入) / 1 xfailed

backend/app/api/dashboard.py

@@ -79,7 +79,10 @@ def get_dashboard_summary(role: str = Query("ceo"), period: str = Query("month")
         return cached
     kpi_total = db.query(func.count(KPIDefinition.id)).filter(
         KPIDefinition.status == "active", KPIDefinition.entity_id == entity_id).scalar()
-    alert_count = db.query(func.count(KPIAlert.id)).filter(KPIAlert.status == "pending").scalar()
+    alert_count = db.query(func.count(KPIAlert.id)).filter(
+        KPIAlert.entity_id == entity_id,
+        KPIAlert.status == "pending",
+    ).scalar()
     dims = db.query(KPIDefinition.dimension, func.count(KPIDefinition.id)).filter(
         KPIDefinition.status == "active", KPIDefinition.entity_id == entity_id
     ).group_by(KPIDefinition.dimension).all()