fix(cma): scope read-side ai-suggestion detail/preview and map nodes

-m- ai_suggestions.get_suggestion: filter by session entity_id (foreign 404)

- ai_suggestions.preview_suggestion: use the existing entity_id dependency in the query

- deviation_push.get_map_nodes: add entity_id dependency and (entity_id or 1) ownership guard

- tests: 4 regression cases (3 RED -> GREEN + auth baseline 401)

backend/app/api/deviation_push.py

@@ -199,10 +199,11 @@ def push_deviation_to_map(
 
 
 @router.get("/map-nodes/{map_id}")
-def get_map_nodes(map_id: int, db: Session = Depends(get_db)):
+def get_map_nodes(map_id: int, db: Session = Depends(get_db),
+                  entity_id: int = Depends(get_entity_id)):
     """获取战略地图的全部节点（供反打选择使用）"""
     m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
-    if not m:
+    if not m or (m.entity_id or 1) != entity_id:   # 2026-09-18 派生单: NULL 归属按 e1 兼容（同 push 护栏）
         raise HTTPException(404, "战略地图不存在")
 
     dims = m.dimensions