fix(security): 16 mittlere Probleme behoben (P18-P33)

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

app/plugins/builtins/unified_search/contracts.py

@@ -5,6 +5,8 @@ from __future__ import annotations
 from app.plugins.builtins.contracts import get_contract_registry
 from app.plugins.builtins.unified_search.embedding import generate_embedding
 from app.plugins.builtins.unified_search.search_engine import hybrid_search
+from app.plugins.builtins.unified_search.provider_registry import get_search_registry
+from app.plugins.builtins.unified_search.base_provider import BaseSearchProvider
 
 
 class UnifiedSearchContract:
@@ -14,6 +16,8 @@ class UnifiedSearchContract:
 
     generate_embedding = staticmethod(generate_embedding)
     hybrid_search = staticmethod(hybrid_search)
+    get_search_registry = staticmethod(get_search_registry)
+    BaseSearchProvider = BaseSearchProvider
 
 
 # ─── self-registration ───
@@ -32,4 +36,4 @@ def get_contract() -> UnifiedSearchContract:
     return _contract_instance
 
 
-__all__ = ["UnifiedSearchContract", "generate_embedding", "hybrid_search"]
+__all__ = ["UnifiedSearchContract", "generate_embedding", "hybrid_search", "get_search_registry", "BaseSearchProvider"]

app/plugins/builtins/unified_search/provider_registry.py

@@ -130,9 +130,8 @@ async def auto_register_providers(db: AsyncSession) -> None:
     from app.plugins.builtins.unified_search.providers.user_provider import (
         UserSearchProvider,
     )
-    from app.plugins.builtins.graph_rag.provider import (
-        GraphRAGSearchProvider,
-    )
+    from app.plugins.builtins.graph_rag.contracts import GraphRagContract
+    GraphRAGSearchProvider = GraphRagContract.GraphRAGSearchProvider
 
     registry = get_search_registry()
     registry.clear()