fix(security): close unauthenticated CMA user API surface + audit tool (cma-api-auth-surface-audit-20260914)

Root cause: main.py include_router had no global auth dependency; user routers
(products/cost/predict/...) relied on assert_entity_scope, which treats a
missing session token as the Bot service channel and lets the request through.
Result: 46 user endpoints returned data without any token on a public site.

Changes:
- auth_middleware.py: add require_auth_401 (missing Bearer -> 401, delegates to
  require_auth otherwise); 401/403 semantics are explicit.
- router-level Depends(require_auth_401) on products, cost, predict,
  notifications, permissions, tenant, alignment; endpoint-level on
  /auth/roles and /admin/cache/clear.
- deps.py: document that get_entity_id/assert_entity_scope are NOT auth.
- frontend: add the missing Bearer header to 5 tokenless fetch/axios calls that
  hit the newly protected endpoints (KPIAlignment x2, RolePermissions x2,
  Dashboard x1).
- tests: new test_api_auth_surface_20260914.py (58 cases: no-token 401,
  token 200, cross-entity 403, bot channel unchanged); adapt test_predict /
  test_kpi_forecast to send session tokens like production.
- scripts/audit_api_auth_surface.py: reusable FastAPI dependency-graph audit
  (423 endpoints; A bot / B gap / C public), exits 1 when a B-class gap exists.

backend/app/api/cost.py

@@ -6,6 +6,7 @@ from fastapi import APIRouter, Depends, Query, HTTPException
 from sqlalchemy.orm import Session
 from app.database import get_db
 from app.deps import get_entity_id
+from app.auth_middleware import require_auth_401
 from app.models import StandardCost, ActualCost, AbcActivity, AbcAllocation
 from app.models.cost_model import RESEARCH_PROJECT_TYPES
 from app.utils.cost_engine import (
@@ -14,7 +15,12 @@ from app.utils.cost_engine import (
 )
 
 logger = logging.getLogger("cma.cost")
-router = APIRouter(prefix="/api/cma/cost", tags=["成本分析"])
+# 用户端点：统一要求会话 Bearer 鉴权（cma-api-auth-surface-audit-20260914）
+# 本 router 原无任何鉴权依赖（端点仅 assert_entity_scope，无 token 走"Bot 服务通道"分支放行）
+# → 无 token 可读成本数据、可写标准成本。收口为 require_auth_401（无 token → 401）。
+# Bot 通道走 /api/cma/bot/cost/*（X-BOT-KEY）不受影响。
+router = APIRouter(prefix="/api/cma/cost", tags=["成本分析"],
+                   dependencies=[Depends(require_auth_401)])
 
 
 def _resolve_research_dims(data: dict, current=None) -> tuple: