fix(security): 16 mittlere Probleme behoben (P18-P33)

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

app/plugins/builtins/entity_links/routes.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.db import get_db
 from app.core.visibility import apply_visibility_filter
 from app.deps import get_current_user, require_permission
+from app.services.entity_permission_service import check_entity_access
 from app.plugins.builtins.entity_links.models import EntityLink
 from app.plugins.builtins.entity_links.schemas import EntityLinkRequest
 
@@ -47,6 +48,14 @@ async def link_file_to_entity(
             400, detail={"detail": "Invalid entity_type", "code": "invalid_entity_type"}
         )
 
+    # Verify user has read access to both the file and the target entity
+    has_file_access = await check_entity_access(db, tenant_id, user_id, "file", fid, "read")
+    if not has_file_access:
+        raise HTTPException(403, detail={"detail": "No access to file", "code": "forbidden"})
+    has_entity_access = await check_entity_access(db, tenant_id, user_id, body.entity_type, entity_id, "read")
+    if not has_entity_access:
+        raise HTTPException(403, detail={"detail": "No access to target entity", "code": "forbidden"})
+
     # Check if link already exists
     existing = await db.execute(
         select(EntityLink).where(