fix(cma): scope read-side ai-suggestion detail/preview and map nodes

-m- ai_suggestions.get_suggestion: filter by session entity_id (foreign 404)

- ai_suggestions.preview_suggestion: use the existing entity_id dependency in the query

- deviation_push.get_map_nodes: add entity_id dependency and (entity_id or 1) ownership guard

- tests: 4 regression cases (3 RED -> GREEN + auth baseline 401)

backend/app/api/ai_suggestions.py

@@ -98,9 +98,13 @@ def list_suggestions(
 
 
 @router.get("/{suggestion_id}")
-def get_suggestion(suggestion_id: int, db: Session = Depends(get_db)):
+def get_suggestion(suggestion_id: int, db: Session = Depends(get_db),
+                   entity_id: int = Depends(get_entity_id)):
     """建议详情"""
-    s = db.query(AISuggestion).filter(AISuggestion.id == suggestion_id).first()
+    s = db.query(AISuggestion).filter(
+        AISuggestion.id == suggestion_id,
+        AISuggestion.entity_id == entity_id,   # 2026-09-18 派生单: 建议须归属会话账套
+    ).first()
     if not s:
         raise HTTPException(404, "建议不存在")
     return {"data": _sug_dict(s)}
@@ -291,7 +295,10 @@ def preview_suggestion(suggestion_id: int, db: Session = Depends(get_db),
     - budget_adjust:{kpi_name, period, current_budget, new_budget}
     - action_plan:  {kpi_name, plan_title, assignee, priority, due_date}
     """
-    sug = db.query(AISuggestion).filter(AISuggestion.id == suggestion_id).first()
+    sug = db.query(AISuggestion).filter(
+        AISuggestion.id == suggestion_id,
+        AISuggestion.entity_id == entity_id,   # 2026-09-18 派生单: 预览须归属会话账套（原依赖未用于过滤）
+    ).first()
     if not sug:
         raise HTTPException(404, "建议不存在")
     sd = sug.suggestion_data or {}