fix(cleanup): resolve 9 low-priority issues (P34-P42)

P34: Remove test_sample plugin from production code
P35: Remove CompanyContact=None dead code from contact.py
P36: Change Plugin.config from Text to JSONB (model + migration 0117 + service)
P37: Add AI comment about workspace overengineering in workspace.py
P38: Add container resource limits to docker-compose.yaml
P39: Guest TTL 1800 not found — already migrated to regular users
P40: Add AI comment about missing IP/Device binding in session.py
P41: Fix Redis healthcheck to use auth password
P42: RLS migration history comment already present in alembic/env.py

app/models/contact.py

@@ -254,4 +254,4 @@ class ContactPerson(Base, TenantMixin):
 
 
 # Keep old names for backward compat during migration
-CompanyContact = None  # deprecated — replaced by ContactPerson 1:N
+

app/models/plugin.py

@@ -5,7 +5,8 @@ from __future__ import annotations
 import uuid
 from typing import Any
 
-from sqlalchemy import Boolean, Index, String, Text
+from sqlalchemy import Boolean, Index, String
+from sqlalchemy.dialects.postgresql import JSONB
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
@@ -33,8 +34,8 @@ class Plugin(Base, TimestampMixin):
     active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
     is_core: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
     config: Mapped[dict[str, Any] | None] = mapped_column(
-        Text,
-        nullable=True,  # JSON string for plugin configuration
+        JSONB,
+        nullable=True,  # JSONB for plugin configuration
     )
 
     # Transient attribute for response (not persisted)

app/models/session.py

@@ -2,6 +2,9 @@
 
 ⚠️ Session-Tabelle dient als audit trail. Redis ist der Runtime-Session-Store.
 Dies ist ein bewusstes Dual-System.
+
+⚠️ Sessions sind nicht an IP/Device gebunden (Design-Entscheidung).
+Bei Bedarf IP-Binding hinzufügen.
 """
 
 from __future__ import annotations

app/models/workspace.py

@@ -5,6 +5,9 @@ saved views, and dashboard widgets are visible to a user. They NEVER affect
 RBAC, ABAC, entity permissions, owner/sharing rights, tenant memberships,
 RLS policies, or actual data access rights.
 
+⚠️ 4 Workspace-Tabellen sind überdimensioniert für ein Mini-CRM aber funktional
+korrekt. Bei Gelegenheit vereinfachen.
+
 See: docs/security_kernel.md for the permission intersection rule.
 """