F1 resubmit_reimbursement now requires session entity_id (cross-entity -> 404). F2 validate_reimbursement monthly/yearly cumulative sum is entity-scoped, so other entities' in-flight amounts no longer pollute the limit verdict. Tests: backend/tests/test_cross_entity_isolation_expenses_residual_20260921.py