feat(N4): Restliche Module — Tasks/Kommunikation/Wiki/Reports/Agents/Tags/Search + Navigation + Dashboard-Schnittstelle (#368)

- Scope-Deklarationen: tasks only_mine, kommunikation conversation_ids, wiki category_ids (NEUE contracts.py), report_generator template_ids, automation agent_ids (module_key agents), tags tag_ids, unified_search entity_types dynamisch aus Provider-Registry
- Core-Beiträge: navigation default_route (Startseite) + dashboard widget_app_ids (Widget-TYP-Angebot, Layout bleibt Phase M)
- Backend-Filter (additive UND): /tasks (only_mine), /comm/conversations, /wiki/articles+/categories (Subtree), /reports/print-templates, /agents, /tags, /search GET+POST (entity_types-Schnitt), /miniapps?host=dashboard
- apply_entity_type_scope-Helper (requested ∧ scope)
- Frontend: WorkspaceSwitcher default_route-Navigation, Sidebar workspace-menu_order-Sortierung, workspaceStore moduleMenuOrder()
- Tests: 18/18 Deklarationen + 11/11 Filter (TDD), Frontend 2/2 + Store 18/18, tsc clean, Build OK
- Regression 64 passed (4 Kombi-Failures = Suite-Isolation, solo-bewiesen); Checker 0; Ruff = Vorbestand (Stash-bewiesen)

app/plugins/builtins/report_generator/documents.py

@@ -21,7 +21,7 @@ from app.ai.llm_client import llm_complete
 from app.core.audit import log_audit
 from app.core.db import get_db, set_tenant_context
 from app.core.storage import get_storage_backend
-from app.deps import require_permission
+from app.deps import require_permission, require_workspace_scope
 from app.plugins.builtins.report_generator.document_blocks import (
     BlockValidationError,
     get_document_blocks,
@@ -423,8 +423,13 @@ async def list_letterhead_assets(
 async def list_print_templates(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_permission("reports:read")),
+    workspace_scope: dict | None = Depends(require_workspace_scope("reports")),
 ):
-    """List print templates for the current tenant."""
+    """List print templates for the current tenant.
+
+    Phase N4: an active workspace scope restricts the template list to the
+    configured subset (pure AND — never a grant).
+    """
     tenant_id = uuid_mod.UUID(current_user["tenant_id"])
     q = (
         select(PrintTemplate)
@@ -435,6 +440,12 @@ async def list_print_templates(
         .order_by(PrintTemplate.name)
     )
     items = (await db.execute(q)).scalars().all()
+    if workspace_scope:
+        from app.services.workspace_scope_service import scope_uuid_set
+
+        template_scope = scope_uuid_set(workspace_scope.get("template_ids"))
+        if template_scope is not None:
+            items = [t for t in items if t.id in template_scope]
     return {
         "items": [_template_to_response(t).model_dump() for t in items],
         "total": len(items),