fix(security): 16 mittlere Probleme behoben (P18-P33)

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

app/core/audit.py

@@ -7,7 +7,8 @@ from typing import Any
 
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.models.audit import AuditLog, DeletionLog
+from app.models.audit import AuditLog
+from app.models.entity_history import EntityHistory
 
 
 async def log_audit(
@@ -40,14 +41,21 @@ async def log_deletion(
     entity_type: str,
     entity_id: uuid.UUID,
     entity_snapshot: dict[str, Any],
-) -> DeletionLog:
-    """Create a deletion log entry (immutable snapshot)."""
-    entry = DeletionLog(
+) -> EntityHistory:
+    """Create a deletion history entry (merged from DeletionLog into EntityHistory).
+
+    Stores the full entity snapshot in snapshot_before for forensic recovery.
+    """
+    entry = EntityHistory(
         tenant_id=tenant_id,
         user_id=user_id,
         entity_type=entity_type,
         entity_id=entity_id,
-        entity_snapshot=entity_snapshot,
+        action="delete",
+        snapshot_before=entity_snapshot,
+        snapshot_after=None,
+        changes=None,
+        owner_id=user_id,
     )
     db.add(entry)
     await db.flush()