feat: 账套模式API统一 — entity_id参数全部走get_entity_id + 登录页/切换器接口打通

- kpis/cash/bsc_layers/growth_quality/tax_compliance/data/predict: entity_id参数统一为Depends(get_entity_id)，token优先隔离（原Query(1)/None会被前端显式传参覆盖，存在越权面）
- auth: 新增GET /auth/login-entities(公开,登录页按用户名查授权企业) + /auth/my-entities(切换器) + /me带当前账套
- 前端: 拦截器删除自动附加X-Entity-Id/entity_id; Login公司选择器; MainLayout/ReportCenter切换器改switch-entity重新签发token+整页刷新

backend/app/api/auth.py

@@ -85,9 +85,13 @@ def register(data: dict, db: Session = Depends(get_db)):
 
 
 @router.get("/me")
-def get_me(current_user: User = Depends(require_auth)):
+def get_me(request: Request, current_user: User = Depends(require_auth), db: Session = Depends(get_db)):
     """获取当前用户信息（含当前账套）"""
-    return {
+    from app.auth_middleware import extract_bearer_token, get_token_entity_id
+    token = extract_bearer_token(request)
+    eid = get_token_entity_id(token) if token else None
+    ent = db.query(Entity).filter(Entity.id == eid).first() if eid else None
+    d = {
         "id": current_user.id,
         "username": current_user.username,
         "name": current_user.name,
@@ -95,6 +99,11 @@ def get_me(current_user: User = Depends(require_auth)):
         "role_name": ROLES.get(current_user.role, {}).get("name", current_user.role),
         "phone": current_user.phone,
     }
+    if ent:
+        d["entity_id"] = ent.id
+        d["entity_name"] = ent.name
+        d["entity_short_name"] = ent.short_name
+    return d
 
 
 @router.get("/roles")
@@ -125,6 +134,29 @@ def my_entities(current_user: User = Depends(require_auth), db: Session = Depend
     }
 
 
+@router.get("/my-entities")
+def my_entities_alias(current_user: User = Depends(require_auth), db: Session = Depends(get_db)):
+    """别名：/auth/my-entities（前端切换器调用）"""
+    return my_entities(current_user, db)
+
+
+@router.get("/login-entities")
+def login_entities_options(username: str = None, db: Session = Depends(get_db)):
+    """登录页公司选择器：按用户名返回授权企业（无鉴权，登录前调用；不暴露用户名是否存在）"""
+    if not username:
+        return {"data": []}
+    user = db.query(User).filter(User.username == username).first()
+    if not user:
+        return {"data": []}
+    _ensure_default_grants(db, user.id)
+    ids = _user_entity_ids(db, user.id)
+    ents = db.query(Entity).filter(
+        Entity.id.in_(ids),
+        Entity.status == "active",
+    ).order_by(Entity.id).all()
+    return {"data": [{"id": e.id, "name": e.name, "short_name": e.short_name} for e in ents]}
+
+
 @router.post("/switch-entity")
 def switch_entity(
     data: dict,