Phase 7.2: WebSocket Plugin-Gate fuer kommunikation und ai_ui_control

- Beide WebSocket Endpoints pruefen jetzt Plugin-Aktivierung (global + tenant)
- Fail-closed bei Fehlern
- Pruefung direkt im WebSocket-Endpunkt (Router-Dependency greift bei WS nicht)

app/plugins/builtins/ai_ui_control/routes.py

@@ -227,6 +227,29 @@ async def ai_ui_control_ws(websocket: WebSocket):
     user_id = session_data["user_id"]
     tenant_id = session_data["tenant_id"]
 
+    # Plugin-Gate: check if ai_ui_control plugin is active (global + tenant)
+    from app.core.permission_registry import get_permission_registry
+    from sqlalchemy import text as sa_text
+    from app.core.db import async_session_maker
+    import uuid as _uuid
+    try:
+        registry = get_permission_registry()
+        if not registry.is_plugin_active("ai_ui_control"):
+            await websocket.close(code=4003, reason="Plugin not active")
+            return
+        async with async_session_maker() as db:
+            result = await db.execute(
+                sa_text("SELECT is_active FROM tenant_plugin_activation WHERE plugin_name = :name AND tenant_id = :tid"),
+                {"name": "ai_ui_control", "tid": _uuid.UUID(tenant_id)},
+            )
+            row = result.first()
+            if row is not None and not row[0]:
+                await websocket.close(code=4003, reason="Plugin not active for tenant")
+                return
+    except Exception:
+        await websocket.close(code=4003, reason="Plugin check failed")
+        return
+
     container = get_container()
     if not container.has("ai_ui_control_ws"):
         await websocket.close(code=4003, reason="AI UI Control not available")

app/plugins/builtins/kommunikation/routes.py

@@ -494,6 +494,29 @@ async def websocket_endpoint(
     user_id = session_data["user_id"]
     tenant_id = session_data["tenant_id"]
 
+    # Plugin-Gate: check if kommunikation plugin is active (global + tenant)
+    from app.core.permission_registry import get_permission_registry
+    from sqlalchemy import text as sa_text
+    from app.core.db import async_session_maker
+    import uuid as _uuid
+    try:
+        registry = get_permission_registry()
+        if not registry.is_plugin_active("kommunikation"):
+            await websocket.close(code=4003, reason="Plugin not active")
+            return
+        async with async_session_maker() as db:
+            result = await db.execute(
+                sa_text("SELECT is_active FROM tenant_plugin_activation WHERE plugin_name = :name AND tenant_id = :tid"),
+                {"name": "kommunikation", "tid": _uuid.UUID(tenant_id)},
+            )
+            row = result.first()
+            if row is not None and not row[0]:
+                await websocket.close(code=4003, reason="Plugin not active for tenant")
+                return
+    except Exception:
+        await websocket.close(code=4003, reason="Plugin check failed")
+        return
+
     # Get WebSocket manager from service container
     from app.core.service_container import get_container
     container = get_container()