feat: 多租户隔离P2批2 — 预算/成本/费用/预警规则/BI报表加entity_id

- 12表加entity_id列(预算/偏差/规则/成本4表/费用2表/BI2表/驱动预算)
- 模型: BudgetPlan/StandardCost/ActualCost/AbcActivity/AbcAllocation/DriverFactorBudget/BiReport/Template/BudgetDeviationAlert/ExpenseRule/Reimbursement/AlertRule
- API隔离: budget plans / cost standard+actual / expenses rules+reimb / bi_reports list / alert_rules list 按token企业过滤
- 回填: kpi_id关联按KPI归属, 无关联默认酣客(entity=1); 当前数据全归酣客
- 验证: import+全端点200+pytest 451 passed

backend/app/api/bi_reports.py

@@ -10,6 +10,7 @@ import json
 import logging
 
 from app.database import get_db
+from app.deps import get_entity_id
 from app.auth_middleware import require_auth, require_role
 from app.models import KPIDefinition, KPIValue, BiReportTemplate, BiReport, OperationLog, KPICausality
 
@@ -126,9 +127,9 @@ def delete_template(template_id: int, db: Session = Depends(get_db), user=WRITE_
 # ============================================================
 
 @router.get("")
-def list_reports(db: Session = Depends(get_db)):
-    """获取用户保存的报表"""
-    reports = db.query(BiReport).order_by(BiReport.updated_at.desc()).all()
+def list_reports(db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
+    """获取用户保存的报表（账套隔离: 按token企业, 2026-08-23 P2）"""
+    reports = db.query(BiReport).filter(BiReport.entity_id == entity_id).order_by(BiReport.updated_at.desc()).all()
     result = []
     for r in reports:
         d = {c.name: getattr(r, c.name) for c in BiReport.__table__.columns}