fix(security): 16 mittlere Probleme behoben (P18-P33)

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

alembic/versions/0115_drop_redundant_db_roles.py

@@ -0,0 +1,36 @@
+"""Drop redundant DB roles (crm_platform_admin).
+
+crm_runtime was already dropped in migration 0085.
+crm_platform_admin was created in 0085 for one-time infrastructure use
+and is no longer needed.
+
+Revision ID: 0115
+Revises: 0114
+"""
+
+from alembic import op
+
+revision = "0115"
+down_revision = "0114"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Drop crm_platform_admin if it exists
+    op.execute(
+        "DO $$ BEGIN "
+        "DROP ROLE IF EXISTS crm_platform_admin; "
+        "EXCEPTION WHEN insufficient_privilege THEN NULL; "
+        "WHEN dependent_objects_still_exist THEN NULL; "
+        "END $$;"
+    )
+
+
+def downgrade() -> None:
+    # Recreate crm_platform_admin (for rollback)
+    op.execute(
+        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'crm_platform_admin') THEN "
+        "CREATE ROLE crm_platform_admin NOSUPERUSER NOBYPASSRLS NOLOGIN; "
+        "END IF; END $$;"
+    )

alembic/versions/0116_merge_deletion_log_into_entity_history.py

@@ -0,0 +1,79 @@
+"""Merge deletion_log data into entity_history and drop deletion_log table.
+
+DeletionLog has been merged into EntityHistory with action='delete'.
+This migration migrates existing DeletionLog records and drops the table.
+
+Revision ID: 0116
+Revises: 0115
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0116"
+down_revision = "0115"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Migrate existing deletion_log records to entity_history
+    op.execute(
+        """
+        INSERT INTO entity_history (id, tenant_id, user_id, entity_type, entity_id, action, snapshot_before, snapshot_after, changes, owner_id, created_at)
+        SELECT
+            gen_random_uuid(),
+            tenant_id,
+            user_id,
+            entity_type,
+            entity_id,
+            'delete'::text,
+            entity_snapshot::jsonb,
+            NULL::jsonb,
+            NULL::jsonb,
+            user_id,
+            deleted_at
+        FROM deletion_log
+        ON CONFLICT DO NOTHING;
+        """
+    )
+
+    # Drop the deletion_log table
+    op.execute("DROP TABLE IF EXISTS deletion_log CASCADE;")
+
+
+def downgrade() -> None:
+    # Recreate deletion_log table
+    op.execute(
+        """
+        CREATE TABLE IF NOT EXISTS deletion_log (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            tenant_id UUID NOT NULL,
+            user_id UUID REFERENCES users(id) ON DELETE SET NULL,
+            entity_type VARCHAR(50) NOT NULL,
+            entity_id UUID NOT NULL,
+            entity_snapshot JSONB NOT NULL,
+            deleted_at TIMESTAMPTZ NOT NULL DEFAULT now()
+        );
+        """
+    )
+
+    # Migrate data back from entity_history
+    op.execute(
+        """
+        INSERT INTO deletion_log (id, tenant_id, user_id, entity_type, entity_id, entity_snapshot, deleted_at)
+        SELECT
+            gen_random_uuid(),
+            tenant_id,
+            user_id,
+            entity_type,
+            entity_id,
+            snapshot_before::jsonb,
+            created_at
+        FROM entity_history
+        WHERE action = 'delete' AND snapshot_before IS NOT NULL;
+        """
+    )
+
+    # Remove migrated records from entity_history
+    op.execute("DELETE FROM entity_history WHERE action = 'delete' AND snapshot_before IS NOT NULL;")