fix(cma): entity isolation batch2 (roll-forward/check-timeout/by-id/cost-abc)

Scope: backend/app/api/{alerts,action_plans,budget,cost}.py + tests

Task: 0-P1-project-20260918-entity-isolation-batch2

backend/app/api/action_plans.py

@@ -241,9 +241,11 @@ def update_plan(
     plan_id: int,
     data: dict,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """更新行动计划"""
-    plan = db.query(ActionPlan).filter(ActionPlan.id == plan_id).first()
+    """更新行动计划（账套隔离: join KPI按企业过滤, 2026-09-18）"""
+    plan = db.query(ActionPlan).join(KPIDefinition, KPIDefinition.id == ActionPlan.kpi_id).filter(
+        ActionPlan.id == plan_id, KPIDefinition.entity_id == entity_id).first()
     if not plan:
         raise HTTPException(404, "计划不存在")
 
@@ -285,9 +287,10 @@ def update_plan(
 
 
 @router.delete("/{plan_id}")
-def delete_plan(plan_id: int, db: Session = Depends(get_db)):
-    """删除行动计划"""
-    plan = db.query(ActionPlan).filter(ActionPlan.id == plan_id).first()
+def delete_plan(plan_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
+    """删除行动计划（账套隔离: join KPI按企业过滤, 2026-09-18）"""
+    plan = db.query(ActionPlan).join(KPIDefinition, KPIDefinition.id == ActionPlan.kpi_id).filter(
+        ActionPlan.id == plan_id, KPIDefinition.entity_id == entity_id).first()
     if not plan:
         raise HTTPException(404, "计划不存在")
     db.delete(plan)