-m- ai_suggestions.get_suggestion: filter by session entity_id (foreign 404) - ai_suggestions.preview_suggestion: use the existing entity_id dependency in the query - deviation_push.get_map_nodes: add entity_id dependency and (entity_id or 1) ownership guard - tests: 4 regression cases (3 RED -> GREEN + auth baseline 401)