fix(cma): entity scope for expenses resubmit + cumulative limit check

F1 resubmit_reimbursement now requires session entity_id (cross-entity -> 404).

F2 validate_reimbursement monthly/yearly cumulative sum is entity-scoped,

so other entities' in-flight amounts no longer pollute the limit verdict.

Tests: backend/tests/test_cross_entity_isolation_expenses_residual_20260921.py

backend/app/api/expenses.py

@@ -290,7 +290,9 @@ def validate_reimbursement(db: Session, reimb: ExpenseReimbursement, rules: list
             })
         else:
             # 月度/年度累计: 统计同维度+同费用类型在周期内的已提交金额(含本次)
+            # 账套隔离 2026-09-21：累计口径限本账套（他账套在途不得污染本账套额度判定）
             q = db.query(func.coalesce(func.sum(ExpenseReimbursement.amount), 0)).filter(
+                ExpenseReimbursement.entity_id == reimb.entity_id,
                 ExpenseReimbursement.expense_type == reimb.expense_type,
                 ExpenseReimbursement.id != reimb.id,
                 ExpenseReimbursement.status.in_(["pending", "approved"]),
@@ -519,9 +521,13 @@ def resubmit_reimbursement(
     data: dict = None,
     db: Session = Depends(get_db),
     _=Depends(require_auth),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """被驳回/打回后重新提交 → 重新自动校验"""
-    r = db.query(ExpenseReimbursement).filter(ExpenseReimbursement.id == reimb_id).first()
+    """被驳回/打回后重新提交 → 重新自动校验（账套隔离 2026-09-21：跨账套 → 404）"""
+    r = db.query(ExpenseReimbursement).filter(
+        ExpenseReimbursement.id == reimb_id,
+        ExpenseReimbursement.entity_id == entity_id,
+    ).first()
     if not r:
         raise HTTPException(404, "报销单不存在")
     if r.status not in ("returned", "rejected"):