fix(security): 16 mittlere Probleme behoben (P18-P33)

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

app/routes/roles.py

@@ -16,6 +16,7 @@ from app.core.permission_registry import get_permission_registry
 from app.core.permissions import invalidate_all_user_permissions
 from app.deps import require_permission
 from app.models.plugin import Plugin as PluginModel
+from app.models.user import UserTenant
 from app.plugins.registry import get_registry
 from app.schemas.role import RoleCreate, RoleUpdate
 from app.services.role_service import role_service
@@ -178,9 +179,19 @@ async def update_role(
     if role is None:
         raise HTTPException(404, detail={"detail": "Role not found", "code": "not_found"})
 
-    # Invalidate permission cache for all users in this tenant
+    # Invalidate permission cache for all users across all their tenants
     redis = get_redis()
-    await invalidate_all_user_permissions(redis, tenant_id)
+    tenant_ids = {tenant_id}
+    ut_q = select(UserTenant.tenant_id).where(
+        UserTenant.user_id.in_(
+            select(UserTenant.user_id).where(UserTenant.tenant_id == tenant_id)
+        )
+    )
+    ut_result = await db.execute(ut_q)
+    for (tid,) in ut_result.all():
+        tenant_ids.add(tid)
+    for tid in tenant_ids:
+        await invalidate_all_user_permissions(redis, tid)
 
     # Audit log
     acting_user_id = uuid.UUID(current_user["user_id"])
@@ -218,9 +229,19 @@ async def delete_role(
     if not success:
         raise HTTPException(404, detail={"detail": "Role not found", "code": "not_found"})
 
-    # Invalidate permission cache for all users in this tenant
+    # Invalidate permission cache for all users across all their tenants
     redis = get_redis()
-    await invalidate_all_user_permissions(redis, tenant_id)
+    tenant_ids = {tenant_id}
+    ut_q = select(UserTenant.tenant_id).where(
+        UserTenant.user_id.in_(
+            select(UserTenant.user_id).where(UserTenant.tenant_id == tenant_id)
+        )
+    )
+    ut_result = await db.execute(ut_q)
+    for (tid,) in ut_result.all():
+        tenant_ids.add(tid)
+    for tid in tenant_ids:
+        await invalidate_all_user_permissions(redis, tid)
 
     acting_user_id = uuid.UUID(current_user["user_id"])
     await log_audit(db, tenant_id, acting_user_id, "delete", "role", rid)