feat(N4): Restliche Module — Tasks/Kommunikation/Wiki/Reports/Agents/Tags/Search + Navigation + Dashboard-Schnittstelle (#368)

- Scope-Deklarationen: tasks only_mine, kommunikation conversation_ids, wiki category_ids (NEUE contracts.py), report_generator template_ids, automation agent_ids (module_key agents), tags tag_ids, unified_search entity_types dynamisch aus Provider-Registry
- Core-Beiträge: navigation default_route (Startseite) + dashboard widget_app_ids (Widget-TYP-Angebot, Layout bleibt Phase M)
- Backend-Filter (additive UND): /tasks (only_mine), /comm/conversations, /wiki/articles+/categories (Subtree), /reports/print-templates, /agents, /tags, /search GET+POST (entity_types-Schnitt), /miniapps?host=dashboard
- apply_entity_type_scope-Helper (requested ∧ scope)
- Frontend: WorkspaceSwitcher default_route-Navigation, Sidebar workspace-menu_order-Sortierung, workspaceStore moduleMenuOrder()
- Tests: 18/18 Deklarationen + 11/11 Filter (TDD), Frontend 2/2 + Store 18/18, tsc clean, Build OK
- Regression 64 passed (4 Kombi-Failures = Suite-Isolation, solo-bewiesen); Checker 0; Ruff = Vorbestand (Stash-bewiesen)

docs/api-documentation.md

@@ -300,6 +300,8 @@ Personal per-user dashboards (Phase M2). Owner-only: every query is scoped to te
 
 Workspaces are UI/navigation context only — they never affect permissions or data access (Phase N). Visibility is always Workspace ∧ RLS ∧ ABAC ∧ Permissions. Tab-local workspace selection via `X-Workspace-ID` header; the API client interceptor sets it per tab. Requires `workspaces:*` core permissions.
 
+**Phase N3/N4 list scoping:** with an active `X-Workspace-ID`, list endpoints apply the workspace module scope as a pure AND-restriction (never a grant): contacts (folder subtree + types), dms (folder subtree + file types), mail (accounts), calendar (calendars), tasks (only_mine), communication (conversation subsets), wiki (category subtree), reports (template subsets), agents (agent subsets), tags (tag subsets), search (entity-type intersection on GET/POST). System admins and holders of `workspaces:configure_modules` are exempt (the scope editor needs unrestricted value lists). `GET /miniapps?host=dashboard` additionally limits the offered widget types to the workspace's `widget_app_ids` (chat/window hosts unaffected; personal dashboard layouts stay user-owned, Phase M).
+
 | Method | Path | Description |
 |--------|------|-------------|
 | GET | `/api/v1/workspaces` | List all workspaces for the tenant. |