feat(platform): close AI expense value loop

Add tenant-safe value, telemetry, connector, commercial, and production-readiness foundations.

server/tests/test_employee_behavior_profile_service.py

@@ -105,6 +105,8 @@ def seed_profile_data(db: Session) -> None:
             agent="hermes",
             source="user_message",
             user_id=employee.email,
+            route_json={"tenant_id": "default"},
+            ontology_json={"tenant_id": "default"},
             status="success",
             result_summary="AI 已辅助生成报销说明。",
             started_at=now - timedelta(days=2),
@@ -269,7 +271,11 @@ def test_latest_profile_endpoint_returns_approval_payload() -> None:
             "window_days": 90,
             "expense_type_scope": "travel",
         },
-        headers={"x-auth-username": "auditor", "x-auth-name": "auditor"},
+        headers={
+            "x-auth-username": "auditor",
+            "x-auth-name": "auditor",
+            "x-auth-is-admin": "true",
+        },
     )
 
     assert response.status_code == 200
@@ -353,6 +359,8 @@ def test_current_admin_profile_endpoint_returns_account_usage_profile() -> None:
                     agent="user_agent",
                     source="user_message",
                     user_id="admin",
+                    route_json={"tenant_id": "default"},
+                    ontology_json={"tenant_id": "default"},
                     status="success",
                     result_summary="管理员查看运行概览。",
                     started_at=started_at,
@@ -482,6 +490,7 @@ def test_finish_session_endpoint_closes_active_session() -> None:
     client = TestClient(app)
     response = client.post(
         "/api/v1/auth/sessions/session-active-finish/finish",
+        headers={"X-Auth-Username": "zhangsan@example.com"},
         json={
             "reason": "manual",
             "lastActivityAt": datetime.now(UTC).isoformat(),
@@ -500,6 +509,51 @@ def test_finish_session_endpoint_closes_active_session() -> None:
         assert session.activity_event_count == 5
 
 
+def test_finish_session_endpoint_does_not_close_another_users_session() -> None:
+    session_factory = build_session_factory()
+    login_at = datetime.now(UTC) - timedelta(minutes=9)
+    with session_factory() as db:
+        db.add(
+            UserSessionMetric(
+                session_id="session-owned-by-zhangsan",
+                username="zhangsan@example.com",
+                display_name="张三",
+                employee_no="E1001",
+                email="zhangsan@example.com",
+                login_at=login_at,
+                last_activity_at=login_at,
+                status="active",
+            )
+        )
+        db.commit()
+
+    app = create_app()
+    install_legacy_header_auth_override(app)
+
+    def override_db() -> Generator[Session, None, None]:
+        db = session_factory()
+        try:
+            yield db
+        finally:
+            db.close()
+
+    app.dependency_overrides[get_db] = override_db
+    response = TestClient(app).post(
+        "/api/v1/auth/sessions/session-owned-by-zhangsan/finish",
+        headers={"X-Auth-Username": "lisi@example.com"},
+        json={"reason": "manual", "activityEventCount": 1},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["durationMs"] == 0
+    with session_factory() as db:
+        session = db.query(UserSessionMetric).filter_by(
+            session_id="session-owned-by-zhangsan"
+        ).one()
+        assert session.status == "active"
+        assert session.logout_at is None
+
+
 def test_hermes_scheduler_parses_weekly_profile_cron() -> None:
     scheduler = HermesScheduler()