fix: UploadFile ForwardRef error + WebSocket 403 CSRF block

1. plugin_error_handler.py: Remove return_annotation from copied signature
   to prevent FastAPI ForwardRef('UploadFile') resolution failure on routes
   with file upload endpoints (dms, calendar, mail, kommunikation, ai_assistant)

2. middleware.py: Skip CSRF check for WebSocket upgrade requests
   WebSocket connections use GET with upgrade header — should not be
   blocked by CSRF middleware

app/core/middleware.py

@@ -69,6 +69,10 @@ class CSRFMiddleware(BaseHTTPMiddleware):
     UNSAFE_METHODS = {"POST", "PATCH", "PUT", "DELETE"}
 
     async def dispatch(self, request: Request, call_next):
+        # Skip WebSocket upgrade requests — they use GET and are handled separately
+        if request.headers.get("upgrade", "").lower() == "websocket":
+            return await call_next(request)
+
         if request.method in self.UNSAFE_METHODS:
             # 1. Origin header check
             origin = request.headers.get("origin")

app/core/plugin_error_handler.py

@@ -13,7 +13,7 @@ def wrap_plugin_route(handler):
 
     Copies the original handler's signature so FastAPI sees the correct
     parameters (path params, query params, body, etc.) instead of *args/**kwargs.
-    Avoids copying __annotations__ to prevent ForwardRef('UploadFile') issues.
+    Removes return annotation to prevent ForwardRef('UploadFile') resolution issues.
     """
     @functools.wraps(handler)
     async def wrapper(*args, **kwargs):
@@ -28,13 +28,17 @@ def wrap_plugin_route(handler):
     # Remove annotations that cause ForwardRef resolution issues
     wrapper.__annotations__ = {}
     # Remove __wrapped__ so FastAPI doesn't try to resolve the original signature
-    # (which may have ForwardRef('UploadFile') that can't be resolved)
     if hasattr(wrapper, '__wrapped__'):
         delattr(wrapper, '__wrapped__')
-    # Copy the signature from the original handler so FastAPI sees correct params
+    # Copy the signature from the original handler but remove return annotation
     try:
         orig_sig = inspect.signature(handler)
-        wrapper.__signature__ = orig_sig
+        # Create new signature without return annotation
+        new_params = list(orig_sig.parameters.values())
+        wrapper.__signature__ = orig_sig.replace(
+            parameters=new_params,
+            return_annotation=inspect.Signature.empty,
+        )
     except (ValueError, TypeError):
         pass
     return wrapper