fix(cma): action plan entity_id on create + okr decomposition entity scope

create_plan wrote no entity_id (fell back to model default 1) while the OKR decomposition view filtered weekly_actions by objective_id only, so cross-entity plans leaked into the other tenant view. Write the session entity on create (before adding the read-side condition - order matters) and scope weekly_actions by entity_id. Adds 4 regression tests (both directions + same-entity positive control).

backend/app/api/action_plans.py

@@ -184,6 +184,11 @@ def create_plan(
             _validate_due_date_against_quarter(due_date, obj.quarter)
 
     plan = ActionPlan(
+        # 账套隔离（2026-09-18 batch3 派生单）：必须显式写会话账套 ——
+        # 旧实现不写 entity_id，落模型默认值 1（e2 会话创建的计划库内 entity_id=1，
+        # 实测 OBS1）。list/stats/update/delete 靠 join KPIDefinition 判账套，
+        # 但任何按 ActionPlan.entity_id 过滤的读路径（如 OKR 分解视图）会失效。
+        entity_id=entity_id,
         alert_id=data.get("alert_id"),
         kpi_id=data["kpi_id"],
         objective_id=objective_id,

backend/app/api/okr.py

@@ -547,6 +547,11 @@ def get_okr_decomposition(okr_id: int, db: Session = Depends(get_db),
     week_end = week_start + timedelta(days=7)
     action_plans = db.query(ActionPlan).filter(
         ActionPlan.objective_id == okr_id,
+        # 账套隔离（2026-09-18 batch3 派生单）：objective_id 已由
+        # _get_objective_or_404 校验归属，但计划侧此前无账套条件 →
+        # 对端账套计划（含脏行）会出现在本账套分解视图（实测 OBS2）。
+        # 前置条件：create_plan 必须已写会话账套 entity_id（顺序铁律）。
+        ActionPlan.entity_id == entity_id,
         ActionPlan.due_date.between(week_start, week_end)
     ).all()