fix(security): 16 mittlere Probleme behoben (P18-P33)

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

app/models/__init__.py

@@ -4,7 +4,7 @@ from app.models.address import Address
 from app.models.bank_account import BankAccount
 from app.models.ai_conversation import AIConversation, AIMessage
 from app.models.attachment import Attachment
-from app.models.audit import AuditLog, DeletionLog
+from app.models.audit import AuditLog
 from app.models.auth import ApiToken, PasswordResetToken
 from app.models.contact import Contact, ContactPerson
 from app.models.contact_folder import ContactFolder
@@ -43,7 +43,6 @@ __all__ = [
     "UserGroup",
     "Session",
     "AuditLog",
-    "DeletionLog",
     "Notification",
     "NotificationType",
     "NotificationPreference",

app/models/address.py

@@ -1,4 +1,8 @@
-"""Address model — polymorphic addresses for companies and contacts."""
+"""Address model — polymorphic addresses for companies and contacts.
+
+⚠️ Address-Tabelle wird für Bank-Accounts genutzt. Contacts nutzen inline Address-Felder.
+Diese Inkonsistenz ist bekannt und wird bei Gelegenheit vereinheitlicht.
+"""
 
 from __future__ import annotations
 

app/models/audit.py

@@ -1,4 +1,7 @@
-"""AuditLog and DeletionLog models."""
+"""AuditLog model — audit trail for all create/update/delete/login actions.
+
+Note: DeletionLog has been merged into EntityHistory (action='delete').
+"""
 
 from __future__ import annotations
 
@@ -33,21 +36,3 @@ class AuditLog(Base, TenantMixin):
         DateTime(timezone=True), nullable=False, server_default=func.now(), index=True
     )
 
-
-class DeletionLog(Base, TenantMixin):
-    """Immutable record of deleted entities (for forensic recovery)."""
-
-    __tablename__ = "deletion_log"
-
-    id: Mapped[uuid.UUID] = mapped_column(
-        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
-    )
-    user_id: Mapped[uuid.UUID | None] = mapped_column(
-        PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
-    )
-    entity_type: Mapped[str] = mapped_column(String(50), nullable=False)
-    entity_id: Mapped[uuid.UUID] = mapped_column(PGUUID(as_uuid=True), nullable=False)
-    entity_snapshot: Mapped[dict[str, Any]] = mapped_column(JSONB, nullable=False)
-    deleted_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )

app/models/entity_policy.py

@@ -1,5 +1,8 @@
 """ABAC entity policy model — attribute-based access control policies.
 
+⚠️ ABAC EntityPolicy ist implementiert aber wird nicht aktiv genutzt.
+Bei echtem Bedarf aktivieren, sonst bei Gelegenheit entfernen.
+
 Each policy defines a rule for a specific entity type:
 - allow policies: at least one must match for access
 - deny policies: if any matches, access is denied (deny takes precedence)

app/models/session.py

@@ -1,4 +1,8 @@
-"""Session model — PostgreSQL audit trail for sessions."""
+"""Session model — PostgreSQL audit trail for sessions.
+
+⚠️ Session-Tabelle dient als audit trail. Redis ist der Runtime-Session-Store.
+Dies ist ein bewusstes Dual-System.
+"""
 
 from __future__ import annotations