fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

Verifikation: Alle 17 Audit-Findings gegen den Code geprueft — alle bestaetigt.
Backend-Lifecycle-Fixes umgesetzt; 4 Frontend-Plugin-Architektur-Punkte
als Phase Q in die Roadmap eingeplant.

- P1 list_workspaces: Module + User-Counts gebuendelt laden (Editor-Overwrite-Bug)
- P1 active-manifests: Tenant-Deaktivierung (tenant_plugin_activation) filtern
- P1 uninstall: volle Service-Deactivation VOR registry.uninstall()
- P1 ContractRegistry: DB-Aktivstatus-Guard (Restart-Edge-Case) + Re-Activate
- P1/P2 Field-Definitions: voller Lifecycle (register/unregister) im Service
- P1/P2 Contact-Felddefinitionen (39) ins ContactsPlugin-Manifest verschoben
- P1 12 fehlende Permission-Keys registriert (AST-Scan: 0 fehlend)
- P2 contact_folder -> ContactsPlugin; ENTITY_PLUGIN_OWNERS wird befuellt
- P2 Entity-Permission-Fallback fail-closed statt contacts:read
- P2 forgejo_error_reporter is_core=False; DMS is_core=True (ADR-020)
- P2 Worker: Contacts-Trash-Cleanup ins Plugin (get_job_modules-Discovery)
- P1/P2 DSGVO-Export delegiert an DSAR-Collector (kein Core->Contacts)
- P2 False-green Tests korrigiert (or True, veraltete Route-Count-Assertion)

Verifikation: tests/test_audit_architecture_fixes.py 17/17; Regressionen
gruen (contacts_lifecycle, entity_registry, workspace_scopes, rbac,
lifecycle_service); Combo-Order-Test 35/35; Cross-Plugin-Checker 497/0;
compileall sauber; ruff auf 7-Error-Baseline.

Doku: PROGRESS.md Audit-Section, PLATFORM_ROADMAP.md Phase Q (Q1-Q4),
plugin-development-guide.md Lifecycle, permissions.md Katalog.

app/core/worker.py

@@ -396,7 +396,6 @@ async def cleanup_trash_job(ctx: dict[str, Any]) -> None:
     from sqlalchemy import text as sa_text
 
     from app.core.db import get_worker_session_factory
-    from app.models.contact import Contact
     from app.models.entity_attachment import EntityAttachment
 
     factory = get_worker_session_factory()
@@ -414,16 +413,9 @@ async def cleanup_trash_job(ctx: dict[str, Any]) -> None:
                     {"tid": str(tenant_id)},
                 )
 
-                # Delete soft-deleted contacts
-                result = await db.execute(
-                    sa_delete(Contact).where(
-                        Contact.deleted_at.is_not(None),
-                        Contact.deleted_at < cutoff,
-                    )
-                )
-                total_deleted += result.rowcount
-
                 # Delete soft-deleted entity attachments
+                # (Contacts trash cleanup moved to the contacts plugin:
+                # cleanup_contacts_trash — audit P2, no core->contacts import)
                 result = await db.execute(
                     sa_delete(EntityAttachment).where(
                         EntityAttachment.deleted_at.is_not(None),
@@ -488,6 +480,12 @@ class WorkerSettings:
             _wrap_cron_with_lock("cleanup_trash", cleanup_trash_job, ttl_seconds=300),
             hour=4, minute=0,
         ),
+        # Contacts trash cleanup — daily at 04:15, owned by the contacts
+        # plugin (audit P2: no core->contacts import in the worker).
+        cron(
+            _wrap_cron_with_lock("cleanup_contacts_trash", get_job("cleanup_contacts_trash"), ttl_seconds=300),
+            hour=4, minute=15,
+        ),
         # Knowledge retention cleanup — daily at 05:00 (90 days, keeps approved).
         # Function comes from the knowledge plugin via the job registry.
         cron(