AI 分析报告按用户隔离存储

个股/财务/复盘报告改为 data/user_data/reports/{username}/ 目录下，
API 端从 request.state.username 读取对应用户的报告。

Co-Authored-By: Claude <noreply@anthropic.com>

serve/backend/app/api/financials.py

@@ -151,11 +151,12 @@ class SaveReportRequest(BaseModel):
 
 @router.get("/reports")
 def list_reports(request: Request):
-    """获取全部历史报告(按时间降序,后端已裁剪到上限)。无需 FINANCIAL 能力读取列表元信息。"""
+    """获取当前用户的历史报告(按时间降序,后端已裁剪到上限)。"""
     capset = request.app.state.capabilities
     if not capset.has(Cap.FINANCIAL):
         return {"reports": []}
-    return {"reports": ai_reports.list_reports()}
+    username = getattr(request.state, "username", None)
+    return {"reports": ai_reports.list_reports(username)}
 
 
 @router.post("/reports")
@@ -163,6 +164,7 @@ def save_report(request: Request, req: SaveReportRequest):
     """保存一条报告。"""
     capset = request.app.state.capabilities
     capset.require(Cap.FINANCIAL)
+    username = getattr(request.state, "username", None)
     report = ai_reports.save_report({
         "symbol": req.symbol,
         "name": req.name,
@@ -170,7 +172,7 @@ def save_report(request: Request, req: SaveReportRequest):
         "content": req.content,
         "periods": req.periods,
         "summary": req.summary,
-    })
+    }, username)
     return {"ok": True, "report": report}
 
 
@@ -179,5 +181,6 @@ def delete_report(request: Request, report_id: str):
     """删除一条报告。"""
     capset = request.app.state.capabilities
     capset.require(Cap.FINANCIAL)
-    ok = ai_reports.delete_report(report_id)
+    username = getattr(request.state, "username", None)
+    ok = ai_reports.delete_report(report_id, username)
     return {"ok": ok}