feat(tenant): Dept/Workgroup 补 TenantUUID 列 + 回填迁移，消除跨表隔离反射补偿

- gerp 模型 Department/Workgroup 新增 TenantUUID(nullable)
- 迁移 0028：AddField + RunPython 从 Company.TenantUUID 回填（待 migrate 执行）
- 配合 SDK 映射同步加字段，组织表结构对齐

gvsds/apps/gerp/migrations/0028_tenant_uuid_backfill.py

@@ -0,0 +1,48 @@
+"""Add TenantUUID to Dept / Workgroup (backfill from Company.TenantUUID)
+
+组织表补齐租户 UUID，消除跨租户查询的反射补偿：
+- Dept.TenantUUID 回填 = CompanyUUID → Company.TenantUUID
+- Workgroup.TenantUUID 回填 = CompanyUUID → Company.TenantUUID
+"""
+from django.db import migrations
+import gvsds.apps.core.models
+
+
+def backfill_tenant_uuid(apps, schema_editor):
+    """从关联 Company 的 TenantUUID 回填 Dept/Workgroup.TenantUUID"""
+    Company = apps.get_model('gerp', 'Company')
+    Department = apps.get_model('gerp', 'Department')
+    Workgroup = apps.get_model('gerp', 'Workgroup')
+
+    company_tenant = dict(
+        Company.objects.exclude(TenantUUID__isnull=True).values_list('CompanyUUID', 'TenantUUID')
+    )
+    for dept in Department.objects.select_related('CompanyUUID').only('DeptUUID', 'CompanyUUID').iterator():
+        tenant = company_tenant.get(dept.CompanyUUID_id)
+        if tenant:
+            Department.objects.filter(DeptUUID=dept.DeptUUID).update(TenantUUID=tenant)
+    for wg in Workgroup.objects.select_related('CompanyUUID').only('WorkgroupUUID', 'CompanyUUID').iterator():
+        tenant = company_tenant.get(wg.CompanyUUID_id)
+        if tenant:
+            Workgroup.objects.filter(WorkgroupUUID=wg.WorkgroupUUID).update(TenantUUID=tenant)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('gerp', '0027_appconfig_company'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='department',
+            name='TenantUUID',
+            field=gvsds.apps.core.models.UUIDField(blank=True, null=True, verbose_name='租户UUID'),
+        ),
+        migrations.AddField(
+            model_name='workgroup',
+            name='TenantUUID',
+            field=gvsds.apps.core.models.UUIDField(blank=True, null=True, verbose_name='租户UUID'),
+        ),
+        migrations.RunPython(backfill_tenant_uuid, migrations.RunPython.noop),
+    ]

gvsds/apps/gerp/models.py

@@ -163,6 +163,7 @@ class Department(QModel):
     """部门表——组织架构层级"""
 
     DeptUUID = UUIDField(primary_key=True, verbose_name='部门UUID')
+    TenantUUID = UUIDField(null=True, blank=True, verbose_name='租户UUID')
     CompanyUUID = models.ForeignKey('Company', on_delete=models.CASCADE, related_name='department_set', db_column='CompanyUUID', verbose_name='公司UUID')
     ParentDeptUUID = models.ForeignKey('self', on_delete=models.SET_NULL, null=True, blank=True, related_name='children', db_column='ParentDeptUUID', verbose_name='上级部门UUID')
     DeptName = models.CharField(max_length=256, verbose_name='部门名称')
@@ -306,6 +307,7 @@ class Workgroup(QModel):
     """工作组表——跨部门协作单元，归属特定公司"""
 
     WorkgroupUUID = UUIDField(primary_key=True, verbose_name='工作组UUID')
+    TenantUUID = UUIDField(null=True, blank=True, verbose_name='租户UUID')
     CompanyUUID = models.ForeignKey('Company', on_delete=models.CASCADE, related_name='+', db_column='CompanyUUID', verbose_name='公司UUID')
     WorkgroupName = models.CharField(max_length=256, verbose_name='工作组名称')
     WorkgroupEnglishName = models.CharField(max_length=256, verbose_name='工作组英文名')