fix(security): Fix critical permission system issues

Problem 1: Remove legacy role bypass
- Remove role="admin" string bypass in permissions.py resolve_permissions()
- Remove role="admin"/"editor" bypass in auth.py check_permission()
- Remove legacy role string fallback in deps.py require_admin/require_write
- Add migration 0112: Create Role records for built-in roles and link role_id
- KI-Kommentar: Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben

Problem 2: Enforce API token scopes
- Add _token_scopes check in require_permission() in deps.py
- When _token_scopes is set (API token auth), required permission must be in scopes
- When _token_scopes not set (session auth), normal permission check applies

Problem 3: Migration chain verification
- Chain is already linear: 0027→0028_rls_force→0028_user_preferences→0029
- user_preferences table confirmed exists in DB
- No duplicate revision IDs found

Problem 4: RLS for remaining tenant tables
- Add migration 0111: Dynamic RLS activation for any remaining tables with tenant_id
- Login tables and global tables explicitly excluded
- DB check shows 0 tables currently missing RLS (safety net migration)

Problem 5: Permission cache invalidation on tenant switch
- Add invalidate_permission_cache() call in switch_tenant() for old tenant
- Stale cached permissions from old tenant no longer leak

Problem 6+7: Guest system removal
- Remove get_current_guest() from deps.py
- Remove guest_auth.py router from main.py and routes/__init__.py
- Rewrite guests.py to use regular User/UserTenant with role=guest
- Remove GuestUser/GuestInvitation from models/__init__.py
- Add migration 0113: Migrate guest_users to regular users, drop guest tables
- Update frontend GuestLogin/GuestContacts to redirect to normal pages
- KI-Kommentar: Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest

app/core/permissions.py

@@ -245,35 +245,10 @@ async def resolve_permissions(
             if role.field_permissions:
                 _merge_field_permissions(field_perms, role.field_permissions)
 
-    # Also check built-in role string on UserTenant for backward compatibility
-    if user_tenant is not None and user_tenant.role_id is None:
-        legacy_role = user_tenant.role
-
-        if legacy_role == "admin":
-            allowed.add("*:*")
-        elif legacy_role == "editor":
-            allowed |= {
-                "contacts:read", "contacts:write",
-                "users:read", "roles:read", "audit:read",
-                "attachments:read", "attachments:write",
-                "workflows:read", "workflows:write",
-                "sequences:read", "sequences:write",
-                "addresses:read", "addresses:write",
-                "taxes:read", "taxes:write",
-                "currencies:read", "currencies:write",
-                "notifications:read", "notifications:write",
-                "import_export:read", "import_export:write",
-                "user_preferences:read", "user_preferences:write",
-            }
-        elif legacy_role == "viewer":
-            allowed |= {
-                "contacts:read", "users:read", "roles:read",
-                "audit:read", "attachments:read", "workflows:read",
-                "sequences:read", "addresses:read", "taxes:read",
-                "currencies:read", "notifications:read",
-                "import_export:read",
-                "user_preferences:read", "user_preferences:write",
-            }
+    # ⚠️ Legacy Role Bypass entfernt — alle Admins müssen echte role_id haben
+    # Built-in role strings (admin/editor/viewer) no longer grant permissions directly.
+    # All permissions must come through the Role-based RBAC system (role_id → Role.permissions).
+    # Migration 0112 creates Role records for existing users and links role_id.
 
     # Load group permissions
     async with db.begin_nested():