feat(N4): Restliche Module — Tasks/Kommunikation/Wiki/Reports/Agents/Tags/Search + Navigation + Dashboard-Schnittstelle (#368)

- Scope-Deklarationen: tasks only_mine, kommunikation conversation_ids, wiki category_ids (NEUE contracts.py), report_generator template_ids, automation agent_ids (module_key agents), tags tag_ids, unified_search entity_types dynamisch aus Provider-Registry
- Core-Beiträge: navigation default_route (Startseite) + dashboard widget_app_ids (Widget-TYP-Angebot, Layout bleibt Phase M)
- Backend-Filter (additive UND): /tasks (only_mine), /comm/conversations, /wiki/articles+/categories (Subtree), /reports/print-templates, /agents, /tags, /search GET+POST (entity_types-Schnitt), /miniapps?host=dashboard
- apply_entity_type_scope-Helper (requested ∧ scope)
- Frontend: WorkspaceSwitcher default_route-Navigation, Sidebar workspace-menu_order-Sortierung, workspaceStore moduleMenuOrder()
- Tests: 18/18 Deklarationen + 11/11 Filter (TDD), Frontend 2/2 + Store 18/18, tsc clean, Build OK
- Regression 64 passed (4 Kombi-Failures = Suite-Isolation, solo-bewiesen); Checker 0; Ruff = Vorbestand (Stash-bewiesen)

app/plugins/builtins/tasks/services.py

@@ -16,7 +16,7 @@ def _to_uuid(val: str | UUID | None) -> UUID | None:
         return val
     return uuid.UUID(str(val))
 
-from sqlalchemy import func, select  # noqa: E402 — after helper defs by design
+from sqlalchemy import func, or_, select  # noqa: E402 — after helper defs by design
 from sqlalchemy.ext.asyncio import AsyncSession  # noqa: E402
 
 from app.core.visibility import apply_visibility_filter  # noqa: E402
@@ -215,10 +215,26 @@ async def list_tasks(
     task_type: str | None = None,
     user_id: uuid.UUID | None = None,
     is_system_admin: bool = False,
+    workspace_scope: dict | None = None,
 ) -> dict[str, Any]:
-    """List tasks with filtering and pagination."""
+    """List tasks with filtering and pagination.
+
+    Phase N4: ``workspace_scope`` with only_mine=true restricts the list to
+    tasks assigned to or created by the current user (pure AND on top of
+    all other filters — never a grant).
+    """
     query = select(Task).where(Task.tenant_id == tenant_id, Task.deleted_at.is_(None))
 
+    # Phase N4: workspace scope — only_mine restricts to own tasks (assigned
+    # to OR created by the current user). Pure AND, never a grant.
+    if workspace_scope and workspace_scope.get("only_mine") is True and user_id:
+        query = query.where(
+            or_(
+                Task.assigned_to == user_id,
+                Task.created_by == user_id,
+            )
+        )
+
     if user_id and not is_system_admin:
         query = await apply_visibility_filter(
             db, query, "task", Task, user_id, tenant_id, is_system_admin