fix(cma): entity isolation batch2 (roll-forward/check-timeout/by-id/cost-abc)

Scope: backend/app/api/{alerts,action_plans,budget,cost}.py + tests

Task: 0-P1-project-20260918-entity-isolation-batch2

backend/app/api/budget.py

@@ -534,12 +534,14 @@ def set_budget_config(
 def budget_roll_forward(
     db: Session = Depends(get_db),
     current_user=Depends(require_auth),
+    entity_id: int = Depends(get_entity_id),
 ):
     """
     滚动预算自动延展：
     - 删除最早一个月的预测数据
     - 新增未来一个月的预测数据（取最近三个月均值）
     - 返回延展结果
+    账套隔离：只处理会话账套（join kpi_definitions 按企业过滤），2026-09-18
     """
     from app.models import SystemConfig
     cfg = db.query(SystemConfig).filter(SystemConfig.config_key == "budget_mode").first()
@@ -557,8 +559,11 @@ def budget_roll_forward(
     now = datetime.now()
     current_year, current_month = now.year, now.month
 
-    # 获取所有active的预算记录
-    plans = db.query(BudgetPlan).filter(BudgetPlan.status == "active").all()
+    # 获取本账套 active 的预算记录（账套隔离: join KPI 按企业过滤, 2026-09-18 — 原为全账套）
+    plans = (db.query(BudgetPlan)
+             .join(KPIDefinition, BudgetPlan.kpi_id == KPIDefinition.id)
+             .filter(BudgetPlan.status == "active", KPIDefinition.entity_id == entity_id)
+             .all())
 
     # 按KPI分组
     from collections import defaultdict
@@ -598,6 +603,7 @@ def budget_roll_forward(
 
         if not existing:
             bp = BudgetPlan(
+                entity_id=entity_id,
                 kpi_id=kpi_id,
                 period=new_period,
                 budget_value=avg_value,