fix(security): Fix critical permission system issues

Problem 1: Remove legacy role bypass
- Remove role="admin" string bypass in permissions.py resolve_permissions()
- Remove role="admin"/"editor" bypass in auth.py check_permission()
- Remove legacy role string fallback in deps.py require_admin/require_write
- Add migration 0112: Create Role records for built-in roles and link role_id
- KI-Kommentar: Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben

Problem 2: Enforce API token scopes
- Add _token_scopes check in require_permission() in deps.py
- When _token_scopes is set (API token auth), required permission must be in scopes
- When _token_scopes not set (session auth), normal permission check applies

Problem 3: Migration chain verification
- Chain is already linear: 0027→0028_rls_force→0028_user_preferences→0029
- user_preferences table confirmed exists in DB
- No duplicate revision IDs found

Problem 4: RLS for remaining tenant tables
- Add migration 0111: Dynamic RLS activation for any remaining tables with tenant_id
- Login tables and global tables explicitly excluded
- DB check shows 0 tables currently missing RLS (safety net migration)

Problem 5: Permission cache invalidation on tenant switch
- Add invalidate_permission_cache() call in switch_tenant() for old tenant
- Stale cached permissions from old tenant no longer leak

Problem 6+7: Guest system removal
- Remove get_current_guest() from deps.py
- Remove guest_auth.py router from main.py and routes/__init__.py
- Rewrite guests.py to use regular User/UserTenant with role=guest
- Remove GuestUser/GuestInvitation from models/__init__.py
- Add migration 0113: Migrate guest_users to regular users, drop guest tables
- Update frontend GuestLogin/GuestContacts to redirect to normal pages
- KI-Kommentar: Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest

app/core/auth.py

@@ -301,17 +301,13 @@ def check_permission(
     role_name: str, module: str, action: str, permissions: dict | None = None
 ) -> bool:
     """Check if a role has permission for a module+action.
-    Built-in roles: admin (all), editor (read+write), viewer (read only).
-    Custom roles use the permissions dict.
+
+    ⚠️ Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben
+    Built-in role strings (admin/editor/viewer) no longer grant permissions directly.
+    All permission checks must go through the RBAC system in app.core.permissions.
+    This function is kept for backward compatibility but no longer bypasses checks
+    based on role_name alone.
     """
-    if role_name == "admin":
-        return True
-    if role_name == "editor":
-        if action in ("read", "write", "create", "update"):
-            return True
-        return False
-    if role_name == "viewer":
-        return action == "read"
     # Custom role — check permissions dict
     if permissions:
         module_perms = permissions.get(module, {})