feat(N3): Backend respektiert X-Workspace-ID bei Listen — contacts/dms/mail/calendar (#367)

- Core-Resolver resolve_workspace_scope(): Zuweisungs-Check, leere Werte fallen weg; Exemptions System-Admin + workspaces:configure_modules (Editor-Deadlock)
- require_workspace_scope(module_key) FastAPI-Dependency (deps.py)
- expand_folder_scope(): Ordner-Subtree (zyklensicher) für ContactFolder + DMS Folder; scope_uuid_set() fail-closed
- contacts: folder_ids-Subtree + contact_types auf GET /contacts, List-Cache bei aktivem Scope deaktiviert (Cache-Leak-Gefahr)
- dms: folder_ids-Subtree + file_types (semantische Matcher) auf /files, Baum-Reduktion auf /folders
- mail: account_ids auf /mails, /threads, /accounts
- calendar: calendar_ids auf /calendar/entries, /calendars
- Frontend-Defaults: getModuleConfig() im workspaceStore, ContactsList default_saved_view_id, Calendar default_view
- Tests: 21/21 neu (TDD rot→grün), Regression 81 passed, Checker 0, tsc clean, Vitest grün, Build OK

app/plugins/builtins/calendar/routes.py

@@ -23,7 +23,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.audit import log_audit
 from app.core.db import get_db
-from app.deps import get_current_user, require_admin, require_permission
+from app.deps import get_current_user, require_admin, require_permission, require_workspace_scope
 from app.plugins.builtins.calendar.ics_utils import (
     export_entries_to_ics,
     ics_events_to_entry_data,
@@ -168,8 +168,13 @@ async def _check_write_permission(
 async def list_calendars(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(get_current_user),
+    workspace_scope: dict | None = Depends(require_workspace_scope("calendar")),
 ):
-    """AC1: GET /api/v1/calendars → 200 + calendar list."""
+    """AC1: GET /api/v1/calendars → 200 + calendar list.
+
+    Phase N3: applies the active workspace scope (X-Workspace-ID) as a pure
+    AND-restriction (calendar subsets) — never a grant.
+    """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     result = await db.execute(
         select(Calendar).where(
@@ -178,6 +183,13 @@ async def list_calendars(
         )
     )
     cals = result.scalars().all()
+    # Phase N3: workspace scope — calendar picker restriction
+    if workspace_scope:
+        from app.services.workspace_scope_service import scope_uuid_set
+
+        calendar_scope = scope_uuid_set(workspace_scope.get("calendar_ids"))
+        if calendar_scope is not None:
+            cals = [c for c in cals if c.id in calendar_scope]
     return [_calendar_to_dict(c) for c in cals]
 
 
@@ -359,8 +371,13 @@ async def list_entries(
     end: str | None = None,
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(get_current_user),
+    workspace_scope: dict | None = Depends(require_workspace_scope("calendar")),
 ):
-    """AC7: GET /api/v1/calendar/entries?start=...&end=... → 200 + entries in range."""
+    """AC7: GET /api/v1/calendar/entries?start=...&end=... → 200 + entries in range.
+
+    Phase N3: applies the active workspace scope (X-Workspace-ID) as a pure
+    AND-restriction (calendar subsets) — never a grant.
+    """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
     role = current_user.get("role", "viewer")
@@ -370,6 +387,14 @@ async def list_entries(
         CalendarEntry.deleted_at.is_(None),
     )
 
+    # Phase N3: workspace scope — calendar subsets, pure AND
+    if workspace_scope:
+        from app.services.workspace_scope_service import scope_uuid_set
+
+        calendar_scope = scope_uuid_set(workspace_scope.get("calendar_ids"))
+        if calendar_scope is not None:
+            query = query.where(CalendarEntry.calendar_id.in_(calendar_scope))
+
     # Filter private entries: only owner + admin can see
     if role != "admin":
         query = query.where(