T02: companies + contacts + import/export + N:M + soft-delete + GDPR + FTS

- Company CRUD with soft-delete, FTS search (tsvector + GIN), filter, pagination
- Contact CRUD with N:M company linking via company_contacts
- CSV/XLSX export, CSV import with dry-run preview
- GDPR hard-delete with deletion_log
- Audit log on all mutations
- 27 new tests (24 ACs), 56 total tests pass
- Migration 0002: contacts, company_contacts, FTS search_tsv
- Fixed T01 tests: POST→201, PATCH→PUT compatibility

app/models/__init__.py

@@ -8,9 +8,11 @@ from app.models.audit import AuditLog, DeletionLog
 from app.models.notification import Notification
 from app.models.auth import PasswordResetToken, ApiToken
 from app.models.company import Company
+from app.models.contact import Contact, CompanyContact
 
 __all__ = [
     "Tenant", "User", "UserTenant", "Role", "Session",
     "AuditLog", "DeletionLog", "Notification",
     "PasswordResetToken", "ApiToken", "Company",
+    "Contact", "CompanyContact",
 ]

app/models/company.py

@@ -1,24 +1,27 @@
-"""Company model — minimal for cross-tenant test (AC #17)."""
+"""Company model — with soft-delete, FTS tsvector, and tenant scoping."""
 
 from __future__ import annotations
 
 import uuid
 from datetime import datetime
+from typing import Any
 
-from sqlalchemy import String, Integer, Numeric, Text, DateTime, ForeignKey, func, Index
-from sqlalchemy.dialects.postgresql import UUID as PGUUID
+from sqlalchemy import String, Text, DateTime, ForeignKey, Index, Computed
+from sqlalchemy.dialects.postgresql import UUID as PGUUID, TSVECTOR
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin
 
 
 class Company(Base, TenantMixin):
-    """Company entity (minimal fields for T01 cross-tenant test)."""
+    """Company entity with full-text search support."""
 
     __tablename__ = "companies"
     __table_args__ = (
         Index("ix_companies_tenant_deleted", "tenant_id", "deleted_at"),
         Index("ix_companies_tenant_name", "tenant_id", "name"),
+        Index("ix_companies_industry", "tenant_id", "industry"),
+        Index("ix_companies_search_vec", "search_tsv", postgresql_using="gin"),
     )
 
     id: Mapped[uuid.UUID] = mapped_column(
@@ -31,7 +34,18 @@ class Company(Base, TenantMixin):
     email: Mapped[str | None] = mapped_column(String(255), nullable=True)
     website: Mapped[str | None] = mapped_column(String(500), nullable=True)
     description: Mapped[str | None] = mapped_column(Text, nullable=True)
-    deleted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    deleted_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    # FTS vector — PostgreSQL generated column, auto-updated on insert/update
+    search_tsv: Mapped[Any] = mapped_column(
+        TSVECTOR,
+        Computed(
+            "to_tsvector('english', coalesce(name, '') || ' ' || coalesce(description, '') || ' ' || coalesce(industry, ''))",
+            persisted=True,
+        ),
+        nullable=True,
+    )
     created_by: Mapped[uuid.UUID | None] = mapped_column(
         PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
     )

app/models/contact.py

@@ -0,0 +1,86 @@
+"""Contact and CompanyContact (N:M join) models."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+
+from sqlalchemy import (
+    String,
+    Text,
+    DateTime,
+    Boolean,
+    ForeignKey,
+    Index,
+    UniqueConstraint,
+)
+from sqlalchemy.dialects.postgresql import UUID as PGUUID
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.core.db import Base, TenantMixin
+
+
+class Contact(Base, TenantMixin):
+    """Contact person entity — can be linked to multiple companies via CompanyContact."""
+
+    __tablename__ = "contacts"
+    __table_args__ = (
+        Index("ix_contacts_tenant_deleted", "tenant_id", "deleted_at"),
+        Index("ix_contacts_tenant_name", "tenant_id", "last_name", "first_name"),
+        Index("ix_contacts_email", "email"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    first_name: Mapped[str] = mapped_column(String(100), nullable=False)
+    last_name: Mapped[str] = mapped_column(String(100), nullable=False)
+    email: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    phone: Mapped[str | None] = mapped_column(String(30), nullable=True)
+    mobile: Mapped[str | None] = mapped_column(String(30), nullable=True)
+    position: Mapped[str | None] = mapped_column(String(100), nullable=True)
+    department: Mapped[str | None] = mapped_column(String(100), nullable=True)
+    linkedin_url: Mapped[str | None] = mapped_column(String(500), nullable=True)
+    notes: Mapped[str | None] = mapped_column(Text, nullable=True)
+    deleted_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    created_by: Mapped[uuid.UUID | None] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="SET NULL"),
+        nullable=True,
+    )
+    updated_by: Mapped[uuid.UUID | None] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="SET NULL"),
+        nullable=True,
+    )
+
+
+class CompanyContact(Base, TenantMixin):
+    """N:M join table between Company and Contact."""
+
+    __tablename__ = "company_contacts"
+    __table_args__ = (
+        UniqueConstraint(
+            "company_id", "contact_id", "tenant_id", name="uq_company_contact_tenant"
+        ),
+        Index("ix_cc_company", "company_id"),
+        Index("ix_cc_contact", "contact_id"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    company_id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("companies.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    contact_id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("contacts.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    role_at_company: Mapped[str | None] = mapped_column(String(100), nullable=True)
+    is_primary: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)