sprint2: visibility filter + contact service access checks + contacts route integration

app/routes/contacts.py

@@ -69,12 +69,16 @@ async def list_contacts(
 ):
     """List contacts with pagination, FTS search, type/folder filter, sorting."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
     return await contact_service.list_contacts(
         db, tenant_id,
         page=page, page_size=page_size, search=search,
         contact_type=type, folder_id=folder_id,
         sort_by=sort_by, sort_order=sort_order,
         resolved_perms=current_user,
+        user_id=user_id,
+        is_system_admin=is_admin,
     )
 
 
@@ -88,7 +92,12 @@ async def export_contacts(
 ):
     """Stream contacts as CSV."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    csv_data = await contact_service.export_contacts_csv(db, tenant_id, contact_type=type, search=search)
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
+    csv_data = await contact_service.export_contacts_csv(
+        db, tenant_id, contact_type=type, search=search,
+        user_id=user_id, is_system_admin=is_admin,
+    )
     return StreamingResponse(
         io.StringIO(csv_data),
         media_type="text/csv",
@@ -132,10 +141,14 @@ async def get_contact(
 ):
     """Get a single contact with contact_persons."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_admin = current_user.get("is_system_admin", False)
     try:
-        return await contact_service.get_contact(db, tenant_id, contact_id)
+        return await contact_service.get_contact(db, tenant_id, contact_id, user_id=user_id, is_system_admin=is_admin)
     except ValueError as e:
         raise HTTPException(status_code=404, detail=str(e))
+    except PermissionError as e:
+        raise HTTPException(status_code=403, detail=str(e))
 
 
 @router.put("/{contact_id}")