HEL-175: 公司端转账往来汇总接口

新增 GET /api/company/intercompany/summary：会话 company_id 强制隔离，
已确认走 eligible_intercompany_events，待确认单列，Decimal 字符串金额。

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>

server.py

@@ -11,8 +11,8 @@ from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlparse
 
 from bank_importer import (
-    auth, dashboard, importing, ledger_events, manual_records, master_data, matching,
-    multipart, personal_transit, positions, settings, subjects,
+    auth, company_transfers, dashboard, importing, ledger_events, manual_records,
+    master_data, matching, multipart, personal_transit, positions, settings, subjects,
 )
 from bank_importer.db import connect, migrate, utc_now
 
@@ -155,6 +155,11 @@ class AppHandler(SimpleHTTPRequestHandler):
             self._handle_admin_intercompany_evidence(int(admin_evidence.group(1)))
             return
 
+        # Company transfer-summary (HEL-169/HEL-175, eligible_intercompany_events)
+        if path == "/api/company/intercompany/summary":
+            self._handle_company_intercompany_summary(query)
+            return
+
         # B-44 intercompany positions (company, own-company scope)
         if path == "/api/company/intercompany/balances":
             self._handle_company_intercompany_balances(query)
@@ -2858,6 +2863,32 @@ class AppHandler(SimpleHTTPRequestHandler):
             return None, None
         return user, user["company_id"]
 
+    def _handle_company_intercompany_summary(self, query: dict[str, list[str]]) -> None:
+        """Own-company transfer summary; company_id is session-only (HEL-175)."""
+        connection = connect(DB_PATH)
+        try:
+            user, company_id = self._company_intercompany_scope(connection)
+            if company_id is None:
+                return
+            # Front-end must never supply company_id; reject even matching values.
+            if (query.get("company_id") or [None])[0] is not None:
+                self._send_json(
+                    400,
+                    {"status": "error", "message": "不允许传入 company_id 参数。"},
+                )
+                return
+            as_of = (query.get("as_of") or [None])[0]
+            try:
+                payload = company_transfers.company_intercompany_summary(
+                    connection, company_id=int(company_id), as_of=as_of
+                )
+            except company_transfers.TransferSummaryInputError as exc:
+                self._send_json(400, {"status": "error", "message": str(exc)})
+                return
+            self._send_json(200, {"status": "ok", **payload})
+        finally:
+            connection.close()
+
     def _handle_company_intercompany_balances(self, query: dict[str, list[str]]) -> None:
         connection = connect(DB_PATH)
         try: