feat(N3): Backend respektiert X-Workspace-ID bei Listen — contacts/dms/mail/calendar (#367)

- Core-Resolver resolve_workspace_scope(): Zuweisungs-Check, leere Werte fallen weg; Exemptions System-Admin + workspaces:configure_modules (Editor-Deadlock)
- require_workspace_scope(module_key) FastAPI-Dependency (deps.py)
- expand_folder_scope(): Ordner-Subtree (zyklensicher) für ContactFolder + DMS Folder; scope_uuid_set() fail-closed
- contacts: folder_ids-Subtree + contact_types auf GET /contacts, List-Cache bei aktivem Scope deaktiviert (Cache-Leak-Gefahr)
- dms: folder_ids-Subtree + file_types (semantische Matcher) auf /files, Baum-Reduktion auf /folders
- mail: account_ids auf /mails, /threads, /accounts
- calendar: calendar_ids auf /calendar/entries, /calendars
- Frontend-Defaults: getModuleConfig() im workspaceStore, ContactsList default_saved_view_id, Calendar default_view
- Tests: 21/21 neu (TDD rot→grün), Regression 81 passed, Checker 0, tsc clean, Vitest grün, Build OK

app/plugins/builtins/contacts/routes.py

@@ -24,7 +24,7 @@ from app.commands.contact_commands import (
 )
 from app.core.db import get_db
 from app.core.visibility import check_single_entity_access
-from app.deps import get_current_user, get_redis_dep, require_permission
+from app.deps import get_current_user, get_redis_dep, require_permission, require_workspace_scope
 from app.models.contact import Contact
 from app.models.custom_field_definition import CustomFieldDefinition
 from app.plugins.registry import get_registry
@@ -70,10 +70,13 @@ async def list_contacts(
     cursor: str | None = Query(None, description="Keyset pagination cursor (contact UUID)"),
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_permission("contacts:read")),
+    workspace_scope: dict | None = Depends(require_workspace_scope("contacts")),
 ):
     """List contacts with pagination, FTS search, type/folder filter, sorting.
 
     Supports keyset pagination via ``cursor`` parameter for large datasets.
+    Phase N3: applies the active workspace scope (X-Workspace-ID) as a pure
+    AND-restriction (folder subtree + contact types) — never a grant.
     """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
@@ -87,6 +90,7 @@ async def list_contacts(
         user_id=user_id,
         is_system_admin=is_admin,
         cursor=cursor,
+        workspace_scope=workspace_scope,
     )