feat(N4): Restliche Module — Tasks/Kommunikation/Wiki/Reports/Agents/Tags/Search + Navigation + Dashboard-Schnittstelle (#368)

- Scope-Deklarationen: tasks only_mine, kommunikation conversation_ids, wiki category_ids (NEUE contracts.py), report_generator template_ids, automation agent_ids (module_key agents), tags tag_ids, unified_search entity_types dynamisch aus Provider-Registry
- Core-Beiträge: navigation default_route (Startseite) + dashboard widget_app_ids (Widget-TYP-Angebot, Layout bleibt Phase M)
- Backend-Filter (additive UND): /tasks (only_mine), /comm/conversations, /wiki/articles+/categories (Subtree), /reports/print-templates, /agents, /tags, /search GET+POST (entity_types-Schnitt), /miniapps?host=dashboard
- apply_entity_type_scope-Helper (requested ∧ scope)
- Frontend: WorkspaceSwitcher default_route-Navigation, Sidebar workspace-menu_order-Sortierung, workspaceStore moduleMenuOrder()
- Tests: 18/18 Deklarationen + 11/11 Filter (TDD), Frontend 2/2 + Store 18/18, tsc clean, Build OK
- Regression 64 passed (4 Kombi-Failures = Suite-Isolation, solo-bewiesen); Checker 0; Ruff = Vorbestand (Stash-bewiesen)

app/routes/miniapps.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 
 from fastapi import APIRouter, Depends, HTTPException
 
-from app.deps import get_current_user
+from app.deps import get_current_user, require_workspace_scope
 from app.plugins.miniapp_registry import get_miniapp_registry, user_permits
 
 router = APIRouter(prefix="/api/v1/miniapps", tags=["miniapps"])
@@ -23,14 +23,23 @@ _user_permits = user_permits
 async def list_miniapps(
     host: str | None = None,
     current_user: dict = Depends(get_current_user),
+    workspace_scope: dict | None = Depends(require_workspace_scope("dashboard")),
 ):
     """List MiniApps visible to the current user (permission-filtered).
 
     ``?host=chat|dashboard|window`` filters by the hosts declared on the
     MiniApp definition.
+    Phase N4: a workspace scope with widget_app_ids limits the OFFERED
+    widget types — only for host=dashboard (admin boundary). Personal
+    layouts stay user-owned (Phase M split).
     """
     registry = get_miniapp_registry()
     items = [a for a in registry.list_apps(host=host) if _user_permits(current_user, a)]
+    if workspace_scope and host == "dashboard":
+        widget_ids = workspace_scope.get("widget_app_ids")
+        if isinstance(widget_ids, list) and widget_ids:
+            allowed = set(widget_ids)
+            items = [a for a in items if a.get("app_id") in allowed]
     items.sort(key=lambda a: a.get("order", 100))
     return {"items": items, "total": len(items)}