fix(security): 16 mittlere Probleme behoben (P18-P33)

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

app/plugins/builtins/graph_rag/contracts.py

@@ -0,0 +1,33 @@
+"""GraphRAG plugin contract — public interface for cross-plugin access."""
+
+from __future__ import annotations
+
+from app.plugins.builtins.contracts import get_contract_registry
+from app.plugins.builtins.graph_rag.provider import GraphRAGSearchProvider
+
+
+class GraphRagContract:
+    """Public contract for the graph_rag plugin."""
+
+    contract_name = "graph_rag"
+
+    GraphRAGSearchProvider = GraphRAGSearchProvider
+
+
+# ─── self-registration ───
+
+_contract = GraphRagContract()
+get_contract_registry().register("graph_rag", _contract)
+
+# Backward-compatible local accessor
+_contract_instance: GraphRagContract | None = None
+
+
+def get_contract() -> GraphRagContract:
+    global _contract_instance
+    if _contract_instance is None:
+        _contract_instance = GraphRagContract()
+    return _contract_instance
+
+
+__all__ = ["GraphRagContract", "GraphRAGSearchProvider"]

app/plugins/builtins/graph_rag/plugin.py

@@ -37,7 +37,7 @@ class GraphRAGPlugin(BasePlugin):
     async def on_activate(self, db, service_container, event_bus) -> None:
         """Activate plugin: register GraphRAG search provider."""
         from app.plugins.builtins.graph_rag.provider import GraphRAGSearchProvider
-        from app.plugins.builtins.unified_search.provider_registry import get_search_registry
+        from app.plugins.builtins.unified_search.contracts import get_search_registry
 
         registry = get_search_registry()
         try:
@@ -50,7 +50,7 @@ class GraphRAGPlugin(BasePlugin):
 
     async def on_deactivate(self, db, service_container, event_bus) -> None:
         """Deactivate plugin: unregister search provider and contract."""
-        from app.plugins.builtins.unified_search.provider_registry import get_search_registry
+        from app.plugins.builtins.unified_search.contracts import get_search_registry
         get_search_registry().unregister("graph_relationship")
 
         from app.plugins.builtins.contracts import get_contract_registry

app/plugins/builtins/graph_rag/provider.py

@@ -9,7 +9,7 @@ from typing import Any
 from sqlalchemy import text
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.plugins.builtins.unified_search.base_provider import BaseSearchProvider
+from app.plugins.builtins.unified_search.contracts import BaseSearchProvider
 
 logger = logging.getLogger(__name__)