feat(N4): Restliche Module — Tasks/Kommunikation/Wiki/Reports/Agents/Tags/Search + Navigation + Dashboard-Schnittstelle (#368)

- Scope-Deklarationen: tasks only_mine, kommunikation conversation_ids, wiki category_ids (NEUE contracts.py), report_generator template_ids, automation agent_ids (module_key agents), tags tag_ids, unified_search entity_types dynamisch aus Provider-Registry
- Core-Beiträge: navigation default_route (Startseite) + dashboard widget_app_ids (Widget-TYP-Angebot, Layout bleibt Phase M)
- Backend-Filter (additive UND): /tasks (only_mine), /comm/conversations, /wiki/articles+/categories (Subtree), /reports/print-templates, /agents, /tags, /search GET+POST (entity_types-Schnitt), /miniapps?host=dashboard
- apply_entity_type_scope-Helper (requested ∧ scope)
- Frontend: WorkspaceSwitcher default_route-Navigation, Sidebar workspace-menu_order-Sortierung, workspaceStore moduleMenuOrder()
- Tests: 18/18 Deklarationen + 11/11 Filter (TDD), Frontend 2/2 + Store 18/18, tsc clean, Build OK
- Regression 64 passed (4 Kombi-Failures = Suite-Isolation, solo-bewiesen); Checker 0; Ruff = Vorbestand (Stash-bewiesen)

app/plugins/builtins/unified_search/contracts.py

@@ -61,6 +61,68 @@ class UnifiedSearchContract:
 
         await _auto_register(db)
 
+    # ─── Workspace Scopes contribution (Phase N4) ───
+
+    @staticmethod
+    def workspace_scopes() -> list[dict]:
+        """Scope-Dimensionen des search-Moduls: Suchbereiche (N4).
+
+        Options come from the live search provider registry; when it has
+        not been initialized yet (sync context before activation), the
+        built-in provider classes are the deterministic fallback source
+        (same classes auto_register_providers registers at activation).
+        """
+        entity_types = list(get_search_registry().get_entity_types())
+        if not entity_types:
+            from app.plugins.builtins.unified_search.providers import (
+                agent_memory_provider,
+                ai_chat_provider,
+                company_provider,
+                contact_provider,
+                contactperson_provider,
+                conversation_provider,
+                event_provider,
+                file_provider,
+                mail_provider,
+                tag_provider,
+                task_provider,
+                user_provider,
+                workflow_provider,
+            )
+
+            for module in (
+                agent_memory_provider, ai_chat_provider, company_provider,
+                contact_provider, contactperson_provider, conversation_provider,
+                event_provider, file_provider, mail_provider, tag_provider,
+                task_provider, user_provider, workflow_provider,
+            ):
+                for attr in dir(module):
+                    obj = getattr(module, attr)
+                    if (
+                        isinstance(obj, type)
+                        and attr.endswith("Provider")
+                        and attr != "BaseSearchProvider"
+                        and getattr(obj, "entity_type", "")
+                    ):
+                        entity_types.append(obj.entity_type)
+        entity_types = sorted(set(entity_types))
+        return [
+            {
+                "module_key": "search",
+                "dimensions": [
+                    {
+                        "key": "entity_types",
+                        "label": "Suchbereiche",
+                        "control": "multiselect",
+                        "options": [
+                            {"value": et, "label": et.replace("_", " ").title()}
+                            for et in entity_types
+                        ],
+                    },
+                ],
+            }
+        ]
+
     @classmethod
     def get_function(cls, name: str):
         """Return a callable exposed by this contract, or None if absent."""

app/plugins/builtins/unified_search/routes.py

@@ -14,7 +14,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.db import get_db
 from app.core.jobs import enqueue_job
 from app.core.permissions import filter_fields_by_permission, resolve_permissions
-from app.deps import get_current_user, require_permission
+from app.deps import get_current_user, require_permission, require_workspace_scope
 from app.plugins.builtins.unified_search.provider_registry import get_search_registry
 from app.plugins.builtins.unified_search.query_understanding import (
     llm_aggregate_results,
@@ -56,8 +56,13 @@ async def search_get(
     sort: str = Query(default="relevance", description="Sort order: relevance, date, name"),
     current_user: dict = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
+    workspace_scope: dict | None = Depends(require_workspace_scope("search")),
 ) -> SearchResponse:
-    """Perform hybrid search via GET (same as POST but with query params)."""
+    """Perform hybrid search via GET (same as POST but with query params).
+
+    Phase N4: an active workspace scope intersects the requested entity
+    types with the configured search areas (pure AND — never a grant).
+    """
     types_list = entity_types.split(",") if entity_types else None
     tags_list = tags.split(",") if tags else None
     req = SearchRequest(
@@ -70,6 +75,12 @@ async def search_get(
         tags=tags_list,
         sort=sort,
     )
+    if workspace_scope:
+        from app.services.workspace_scope_service import apply_entity_type_scope
+
+        req.entity_types = apply_entity_type_scope(
+            req.entity_types, workspace_scope.get("entity_types")
+        )
     return await _do_search(req, current_user, db)
 
 
@@ -219,8 +230,19 @@ async def search(
     req: SearchRequest,
     current_user: dict = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
+    workspace_scope: dict | None = Depends(require_workspace_scope("search")),
 ) -> SearchResponse:
-    """Perform hybrid search with KI query understanding."""
+    """Perform hybrid search with KI query understanding.
+
+    Phase N4: an active workspace scope intersects the requested entity
+    types with the configured search areas (pure AND — never a grant).
+    """
+    if workspace_scope:
+        from app.services.workspace_scope_service import apply_entity_type_scope
+
+        req.entity_types = apply_entity_type_scope(
+            req.entity_types, workspace_scope.get("entity_types")
+        )
     return await _do_search(req, current_user, db)