fix(security): 16 mittlere Probleme behoben (P18-P33)

P18: require_permission zu forgejo_error_reporter und ai_ui_control routes hinzugefügt
P19: Cross-Tenant Permission-Cache-Invalidierung bei Rollenänderungen
P20: Session/Permission-Cache-Invalidierung bei Gruppen-Änderungen
P21: ENTITY_MODELS Registry um fehlende Plugin-Modelle erweitert
P22: Entity-Links prüfen verknüpfte Entity-Permissions
P23: authStore persist Middleware entfernt (kein localStorage mehr)
P24: 5xx Retry nur noch für GET-Requests
P25: KI-Kommentar in address.py (bekannte Inkonsistenz)
P26: DeletionLog in EntityHistory gemerged (action=delete)
P27: KI-Kommentar in entity_policy.py (ABAC nicht aktiv genutzt)
P28: db.commit() aus bulk_permission_service entfernt
P29: CSV-Export in export_service.py ausgelagert
P30: plugins.py Business-Logik in plugin_install_service.py ausgelagert
P31: KI-Kommentar in session.py (Dual-System dokumentiert)
P32: Migration 0115: crm_platform_admin Role droppen
P33: Cross-Plugin Imports über contracts.py behoben (10 Violations → 0)

frontend/src/api/client.ts

@@ -68,8 +68,9 @@ apiClient.interceptors.response.use(
     const config = error.config as InternalAxiosRequestConfig & { _retried?: boolean };
     const status = error.response?.status || 0;
 
-    // Retry 5xx errors once with a short delay
-    if (status >= 500 && status < 600 && config && !config._retried) {
+    // Retry 5xx errors once with a short delay (GET only — never retry mutations)
+    const method = config?.method?.toLowerCase() ?? '';
+    if (status >= 500 && status < 600 && method === 'get' && config && !config._retried) {
       config._retried = true;
       await new Promise((resolve) => setTimeout(resolve, 500));
       return apiClient.request(config);

frontend/src/store/authStore.ts

@@ -1,5 +1,4 @@
 import { create } from 'zustand';
-import { persist } from 'zustand/middleware';
 
 export interface Tenant {
   id: string;
@@ -35,8 +34,7 @@ export interface AuthState {
 }
 
 export const useAuthStore = create<AuthState>()(
-  persist(
-    (set) => ({
+  (set) => ({
       user: null,
       currentTenant: null,
       isAuthenticated: false,
@@ -70,14 +68,5 @@ export const useAuthStore = create<AuthState>()(
           isAuthenticated: false,
           error: null,
         }),
-    }),
-    {
-      name: 'auth-store',
-      partialize: (state) => ({
-        user: state.user,
-        currentTenant: state.currentTenant,
-        isAuthenticated: state.isAuthenticated,
-      }),
-    }
-  )
+  })
 );