fix(cma): action plan entity_id at the three residual construction sites

alert-to-plan, deviation-push review topic and AI-suggestion-to-plan built ActionPlan(...) without entity_id, so non-e1 sessions wrote rows with the model default 1 and entity_id stayed untrustworthy on those paths. Write the session entity at all three sites, scope the deviation-push topic dedupe by entity (a foreign same-title topic no longer suppresses the session entity's own topic), and require the applied suggestion to belong to the session entity. Adds 7 regression tests (both directions + cross-entity negative controls + auth floor).

backend/app/api/deviation_push.py

@@ -6,6 +6,7 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from app.database import get_db
 from app.auth_middleware import require_auth, require_role
+from app.deps import get_entity_id
 from app.models import StrategicMap, KPIDefinition, KPIValue, KPIAlert, OperationLog, ActionPlan, BudgetPlan
 import json
 import logging
@@ -22,6 +23,7 @@ router = APIRouter(prefix="/api/cma/deviation-push", tags=["差异反打"],
 def push_deviation_to_map(
     data: dict,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
     current_user=Depends(require_auth),
 ):
     """从差异分析回写实际值到战略地图节点
@@ -47,9 +49,9 @@ def push_deviation_to_map(
     if new_value is None:
         raise HTTPException(400, "缺少 newValue")
 
-    # 1. 查找战略地图
+    # 1. 查找战略地图（2026-09-18 派生单: 地图须归属会话账套，NULL 归属按 e1 兼容）
     m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
-    if not m:
+    if not m or (m.entity_id or 1) != entity_id:
         raise HTTPException(404, "战略地图不存在")
 
     # 2. 解析 node_id 格式: "finance-0"
@@ -89,7 +91,7 @@ def push_deviation_to_map(
 
     kpi_code = kpi_codes[0]
     kpi = db.query(KPIDefinition).filter(KPIDefinition.kpi_code == kpi_code).first()
-    if not kpi:
+    if not kpi or (kpi.entity_id or 1) != entity_id:
         raise HTTPException(404, f"KPI {kpi_code} 不存在")
 
     # 3. 更新实际值到 KPIValue 表
@@ -147,11 +149,13 @@ def push_deviation_to_map(
     if create_review_topic:
         topic_title = f"【差异反打】{kpi.kpi_name}偏差回写 — {target_obj.get('name')}"
         existing_topic = db.query(ActionPlan).filter(
+            ActionPlan.entity_id == entity_id,   # 2026-09-18 派生单: 去重按账套隔离
             ActionPlan.title == topic_title,
             ActionPlan.status.in_(["pending", "in_progress"]),
         ).first()
         if not existing_topic:
             topic = ActionPlan(
+                entity_id=entity_id,   # 2026-09-18 派生单: 写会话账套（原落模型默认值 1）
                 kpi_id=kpi.id,
                 title=topic_title,
                 description=f"由差异分析自动生成：将实际值{new_value}回写至战略地图[{target_dim.get('name')}→{target_obj.get('name')}]节点。差异ID: {deviation_id or 'N/A'}",