feat(N4): Restliche Module — Tasks/Kommunikation/Wiki/Reports/Agents/Tags/Search + Navigation + Dashboard-Schnittstelle (#368)

- Scope-Deklarationen: tasks only_mine, kommunikation conversation_ids, wiki category_ids (NEUE contracts.py), report_generator template_ids, automation agent_ids (module_key agents), tags tag_ids, unified_search entity_types dynamisch aus Provider-Registry
- Core-Beiträge: navigation default_route (Startseite) + dashboard widget_app_ids (Widget-TYP-Angebot, Layout bleibt Phase M)
- Backend-Filter (additive UND): /tasks (only_mine), /comm/conversations, /wiki/articles+/categories (Subtree), /reports/print-templates, /agents, /tags, /search GET+POST (entity_types-Schnitt), /miniapps?host=dashboard
- apply_entity_type_scope-Helper (requested ∧ scope)
- Frontend: WorkspaceSwitcher default_route-Navigation, Sidebar workspace-menu_order-Sortierung, workspaceStore moduleMenuOrder()
- Tests: 18/18 Deklarationen + 11/11 Filter (TDD), Frontend 2/2 + Store 18/18, tsc clean, Build OK
- Regression 64 passed (4 Kombi-Failures = Suite-Isolation, solo-bewiesen); Checker 0; Ruff = Vorbestand (Stash-bewiesen)

app/plugins/builtins/wiki/contracts.py

@@ -0,0 +1,55 @@
+"""Wiki plugin contract — public interface for cross-plugin access (N4).
+
+Created for the Phase N workspace_scopes contribution (the wiki previously
+had no contract module — N4 needs one for the scope registry, mirroring the
+contacts/dms/mail/calendar pattern from N1).
+"""
+
+from __future__ import annotations
+
+from app.plugins.builtins.contracts import get_contract_registry
+
+
+class WikiContract:
+    """Public contract for the wiki plugin."""
+
+    contract_name = "wiki"
+
+    # ─── Workspace Scopes contribution (Phase N4) ───
+
+    @staticmethod
+    def workspace_scopes() -> list[dict]:
+        """Scope-Dimensionen des wiki-Moduls: Kategorien-Teilmengen (N4)."""
+        return [
+            {
+                "module_key": "wiki",
+                "dimensions": [
+                    {
+                        "key": "category_ids",
+                        "label": "Wiki-Kategorien",
+                        "control": "multiselect",
+                        "options": [],
+                        "value_source": {
+                            "endpoint": "/api/v1/wiki/categories",
+                            "items_path": "items",
+                            "value_key": "id",
+                            "label_key": "name",
+                        },
+                    },
+                ],
+            }
+        ]
+
+    @classmethod
+    def get_function(cls, name: str):
+        """Return a callable exposed by this contract, or None if absent."""
+        return getattr(cls, name, None)
+
+
+# ─── self-registration ───
+
+_contract = WikiContract()
+get_contract_registry().register("wiki", _contract)
+
+
+__all__ = ["WikiContract"]

app/plugins/builtins/wiki/routes.py

@@ -8,7 +8,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.audit import log_audit
 from app.core.db import get_db
-from app.deps import require_permission
+from app.deps import require_permission, require_workspace_scope
 from app.plugins.builtins.wiki import services
 from app.plugins.builtins.wiki.schemas import (
     ArticleCreate,
@@ -28,11 +28,35 @@ async def list_articles(
     search: str | None = None,
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_permission("wiki:read")),
+    workspace_scope: dict | None = Depends(require_workspace_scope("wiki")),
 ):
-    return await services.list_articles(
+    """List wiki articles.
+
+    Phase N4: an active workspace scope (X-Workspace-ID) restricts articles
+    to the category subtree (category_ids incl. children — pure AND).
+    """
+    scoped_category_ids: set | None = None
+    if workspace_scope:
+        from app.plugins.builtins.wiki.models import WikiCategory
+        from app.services.workspace_scope_service import expand_folder_scope
+
+        raw_ids = workspace_scope.get("category_ids")
+        if isinstance(raw_ids, list) and raw_ids:
+            scoped_category_ids = await expand_folder_scope(db, WikiCategory, raw_ids)
+
+    result = await services.list_articles(
         db, uuid.UUID(current_user["tenant_id"]),
         page=page, page_size=page_size, category_id=category_id, status=status, search=search,
     )
+    # Phase N4: filter to the scoped category subtree (post-fetch AND filter)
+    if scoped_category_ids is not None:
+        items = [
+            a for a in result["items"]
+            if a.get("category_id") and uuid.UUID(a["category_id"]) in scoped_category_ids
+        ]
+        result["items"] = items
+        result["total"] = len(items)
+    return result
 
 
 @router.post("/articles", status_code=status.HTTP_201_CREATED)
@@ -120,8 +144,20 @@ async def restore_version(
 async def list_categories(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_permission("wiki:read")),
+    workspace_scope: dict | None = Depends(require_workspace_scope("wiki")),
 ):
-    return {"items": await services.list_categories(db, uuid.UUID(current_user["tenant_id"]))}
+    """List wiki categories (Phase N4: scope reduces to the category subtree)."""
+    items = await services.list_categories(db, uuid.UUID(current_user["tenant_id"]))
+    if workspace_scope:
+        from app.plugins.builtins.wiki.models import WikiCategory
+        from app.services.workspace_scope_service import expand_folder_scope
+
+        raw_ids = workspace_scope.get("category_ids")
+        if isinstance(raw_ids, list) and raw_ids:
+            subtree = await expand_folder_scope(db, WikiCategory, raw_ids)
+            allowed = subtree or set()
+            items = [c for c in items if uuid.UUID(c["id"]) in allowed]
+    return {"items": items}
 
 
 @router.post("/categories", status_code=status.HTTP_201_CREATED)