Phase 0.1: update planning docs to current state

- codebase-vs-requirements.md: rewritten to reflect actual IST-stand (PostgreSQL, React, 12 plugins, unified contacts)
- security-review-phase2.md: added resolution summary for M-01/M-02/M-03/M-05/m-03/m-08
- architecture.md: added section 11 'Implementation Status' with what's built and what's missing
- MASTER-PLAN.md: comprehensive 754-line plan with 8 phases + Phase 3.5 (~590h total)
- PROGRESS.md: progress tracking file for agent work

architecture.md

@@ -6,6 +6,8 @@
 > **v1 Tasks:** T01, T02, T03, T07, T09, T10
 > **v2 Tasks:** T04, T05, T06, T11, T08a, T08b, T08c
 
+> **Update 2026-07-23:** Implementation Status siehe Abschnitt am Ende dieses Dokuments.
+
 **Projekt:** leocrm — Greenfield
 **Architekt:** Solution Architect (Agent Zero)
 **Datum:** 2026-06-28
@@ -2017,3 +2019,49 @@ e2e/
 - AGENTS.md status: PENDING
 - Open questions: 4 (listed above, non-blocking for implementation)
 - Ready for implementation: NO (pending quality_reviewer review + task graph + AGENTS.md)
+
+---
+
+## 11. Implementation Status (Update 2026-07-23)
+
+### Was implementiert wurde
+
+| Komponente | Status | Anmerkung |
+|-----------|--------|-----------|
+| FastAPI Backend | ✅ Fertig | ~35.800 Zeilen, 22 Routes, 18 Services, 20 Models |
+| PostgreSQL 16 + asyncpg | ✅ Fertig | 22 Alembic-Migrationen |
+| Multi-Tenant + RLS | ✅ Fertig | ORM-Filter + PostgreSQL RLS (Migration 0015) |
+| RBAC + Field-Level Permissions | ✅ Fertig | Role + Groups + Permission Registry |
+| Session-Auth + Rate Limiting | ✅ Fertig | Redis + bcrypt + CSRF |
+| Plugin-System | ✅ Fertig | 12 Plugins, Registry, Manifest, Lifecycle, Migration Runner |
+| Unified Contact Model | ✅ Fertig | Contact type='company'\|'person', ContactPerson 1:N |
+| Workflow Engine | ✅ Fertig | 306 Zeilen, 4 Step-Types, Event-Trigger |
+| KI-Copilot + AI Assistant | ✅ Fertig | LiteLLM + PydanticAI + tool_registry |
+| AI Proactive | ✅ Fertig | Context-aware, SSE, Heartbeat, Deep Analysis |
+| Unified Search | ✅ Fertig | Hybrid FTS+Vector (pgvector), RRF, KI Query Understanding |
+| Kommunikation | ✅ Fertig | WebSocket, MiniApps, Rich Content Blocks |
+| Mail Plugin | ✅ Fertig | IMAP/SMTP, PGP, Vacation, Rules, Templates |
+| Calendar Plugin | ✅ Fertig | ICS, Kanban, Resources, Subtasks, Recurrence |
+| DMS Plugin | ✅ Fertig | Folders, Files, Preview, OnlyOffice (→Collabora), Share |
+| Report Generator | ⚠️ Teilweise | Backend (CSV/Excel/JSON), Frontend fehlt, PDF fehlt |
+| React Frontend | ✅ Fertig | ~30.000 Zeilen, 27 Pages, 70 Components, i18n DE/EN |
+| Docker Multi-Stage Build | ✅ Fertig | Frontend+Backend in einem Container |
+| Monitoring | ✅ Fertig | Prometheus + structlog + Health Checks |
+
+### Was noch fehlt (im MASTER-PLAN.md eingeplant)
+
+Siehe `MASTER-PLAN.md` für den vollständigen Umbau-Plan (~590h, 8 Phasen + Phase 3.5).
+
+Wichtigste Lücken:
+- Storage Backend (S3-Support) — Phase 0.16
+- Company-Routes entfernen (unified Contact) — Phase 1
+- Plugin-UI-System (PluginRegistry/PluginLoader) — Phase 3
+- Automation & Agents Plugin (Agent Builder, Cron-Scheduler) — Phase 3.5
+- KI-UI-Steuerung (WebSocket Commands) — Phase 4
+- E2E Tests (Playwright) — Phase 5
+- Backup-System — Phase 5.15
+- MCP Integration — Phase 5.16-5.17
+- Report Frontend + PDF — Phase 5.18-5.19
+- Custom Fields, Tasks-Plugin, Saved Searches, PWA, Dashboard — Phase 5.20-5.25
+- Code-Splitting + Virtual Scrolling — Phase 2
+- AGPL-Lizenzen ersetzen (PyMuPDF→pypdf, OnlyOffice→Collabora) — Phase 0.20