feat: 多租户隔离P2批2 — 预算/成本/费用/预警规则/BI报表加entity_id

- 12表加entity_id列(预算/偏差/规则/成本4表/费用2表/BI2表/驱动预算)
- 模型: BudgetPlan/StandardCost/ActualCost/AbcActivity/AbcAllocation/DriverFactorBudget/BiReport/Template/BudgetDeviationAlert/ExpenseRule/Reimbursement/AlertRule
- API隔离: budget plans / cost standard+actual / expenses rules+reimb / bi_reports list / alert_rules list 按token企业过滤
- 回填: kpi_id关联按KPI归属, 无关联默认酣客(entity=1); 当前数据全归酣客
- 验证: import+全端点200+pytest 451 passed

backend/app/api/alert_rules.py

@@ -11,6 +11,7 @@ import json
 import logging
 
 from app.database import get_db, Base
+from app.deps import get_entity_id
 from app.auth_middleware import require_auth, require_role
 from app.models import KPIDefinition, KPIValue, KPIAlert, OperationLog
 
@@ -23,6 +24,7 @@ class AlertRule(Base):
     """预警规则配置"""
     __tablename__ = "alert_rules"
     id = Column(Integer, primary_key=True, index=True)
+    entity_id = Column(Integer, default=1, comment="企业ID (P2多租户隔离 2026-08-23)")
     kpi_id = Column(Integer, nullable=False, comment="关联KPI ID")
     rule_type = Column(String(30), nullable=False, comment="static/dynamic/trend_up/trend_down")
     trigger_on = Column(String(20), default="actual", comment="actual/forecast/both — 实际值/预测值/两者触发")
@@ -64,9 +66,10 @@ def list_alert_rules(
     rule_type: Optional[str] = None,
     enabled: Optional[int] = None,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """列出所有预警规则"""
-    query = db.query(AlertRule)
+    """列出所有预警规则（账套隔离: 按token企业, 2026-08-23 P2）"""
+    query = db.query(AlertRule).filter(AlertRule.entity_id == entity_id)
     if kpi_id:
         query = query.filter(AlertRule.kpi_id == kpi_id)
     if rule_type: