feat(cma): allow demo-status entity at login for demo account (yanxue-20260916-cma-demo-account)

LOGIN_ENTITY_STATUSES=("active","demo") applied to login / login-entities / my-entities / switch-entity only; batch pipelines stay active-only so the demo entity never enters daily_push or cash alerts.

backend/app/api/auth.py

@@ -8,6 +8,14 @@ from app.auth_middleware import create_token, require_auth, require_auth_401, RO
 
 router = APIRouter(prefix="/api/cma/auth", tags=["认证"])
 
+# ── 可登录账套状态（2026-09-17 yanxue-20260916-cma-demo-account）─────────────
+# active = 正式账套；demo = 演示账套（虚构数据，专供演示账号登录）。
+# 为何单列「demo」而不是把演示企业改成 active：daily_push / 预警检查等批处理按
+# `Entity.status == "active"` 遍历全部实体，演示实体若为 active 会被并入真实
+# 推送与预警（污染业务通道）。故演示账号只在**登录链**上被放行「demo」状态，
+# 批处理口径（active-only）保持不变。
+LOGIN_ENTITY_STATUSES = ("active", "demo")
+
 
 def _user_entity_ids(db: Session, user_id: int) -> list[int]:
     """返回用户被授权的企业ID列表"""
@@ -47,7 +55,7 @@ def login(data: dict, db: Session = Depends(get_db)):
         raise HTTPException(403, f"该账号未被授权访问企业 entity_id={entity_id}")
 
     entity = db.query(Entity).filter(Entity.id == int(entity_id)).first()
-    if not entity or entity.status != "active":
+    if not entity or entity.status not in LOGIN_ENTITY_STATUSES:
         raise HTTPException(403, f"企业 entity_id={entity_id} 不存在或未激活")
 
     token = create_token(user.id, int(entity_id))
@@ -133,7 +141,7 @@ def my_entities(current_user: User = Depends(require_auth), db: Session = Depend
     ids = _user_entity_ids(db, current_user.id)
     entities = db.query(Entity).filter(
         Entity.id.in_(ids),
-        Entity.status == "active",
+        Entity.status.in_(LOGIN_ENTITY_STATUSES),
     ).order_by(Entity.id).all()
     return {
         "data": [
@@ -161,7 +169,7 @@ def login_entities_options(username: str = None, db: Session = Depends(get_db)):
     ids = _user_entity_ids(db, user.id)
     ents = db.query(Entity).filter(
         Entity.id.in_(ids),
-        Entity.status == "active",
+        Entity.status.in_(LOGIN_ENTITY_STATUSES),
     ).order_by(Entity.id).all()
     return {"data": [{"id": e.id, "name": e.name, "short_name": e.short_name} for e in ents]}
 
@@ -190,7 +198,7 @@ def switch_entity(
         raise HTTPException(403, f"该账号未被授权访问企业 entity_id={entity_id}")
 
     entity = db.query(Entity).filter(Entity.id == int(entity_id)).first()
-    if not entity or entity.status != "active":
+    if not entity or entity.status not in LOGIN_ENTITY_STATUSES:
         raise HTTPException(403, f"企业 entity_id={entity_id} 不存在或未激活")
 
     # 旧token失效：删除当前请求的旧token（切换即下线旧账套凭据）