fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

Verifikation: Alle 17 Audit-Findings gegen den Code geprueft — alle bestaetigt.
Backend-Lifecycle-Fixes umgesetzt; 4 Frontend-Plugin-Architektur-Punkte
als Phase Q in die Roadmap eingeplant.

- P1 list_workspaces: Module + User-Counts gebuendelt laden (Editor-Overwrite-Bug)
- P1 active-manifests: Tenant-Deaktivierung (tenant_plugin_activation) filtern
- P1 uninstall: volle Service-Deactivation VOR registry.uninstall()
- P1 ContractRegistry: DB-Aktivstatus-Guard (Restart-Edge-Case) + Re-Activate
- P1/P2 Field-Definitions: voller Lifecycle (register/unregister) im Service
- P1/P2 Contact-Felddefinitionen (39) ins ContactsPlugin-Manifest verschoben
- P1 12 fehlende Permission-Keys registriert (AST-Scan: 0 fehlend)
- P2 contact_folder -> ContactsPlugin; ENTITY_PLUGIN_OWNERS wird befuellt
- P2 Entity-Permission-Fallback fail-closed statt contacts:read
- P2 forgejo_error_reporter is_core=False; DMS is_core=True (ADR-020)
- P2 Worker: Contacts-Trash-Cleanup ins Plugin (get_job_modules-Discovery)
- P1/P2 DSGVO-Export delegiert an DSAR-Collector (kein Core->Contacts)
- P2 False-green Tests korrigiert (or True, veraltete Route-Count-Assertion)

Verifikation: tests/test_audit_architecture_fixes.py 17/17; Regressionen
gruen (contacts_lifecycle, entity_registry, workspace_scopes, rbac,
lifecycle_service); Combo-Order-Test 35/35; Cross-Plugin-Checker 497/0;
compileall sauber; ruff auf 7-Error-Baseline.

Doku: PROGRESS.md Audit-Section, PLATFORM_ROADMAP.md Phase Q (Q1-Q4),
plugin-development-guide.md Lifecycle, permissions.md Katalog.

app/plugins/registry.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import importlib
 import logging
+import uuid
 from pathlib import Path
 from typing import Any
 
@@ -852,19 +853,43 @@ class PluginRegistry:
 
     # ── Active UI Manifests (Phase 3) ──
 
-    async def get_active_manifests(self, db: AsyncSession) -> list[dict[str, Any]]:
+    async def get_active_manifests(
+        self, db: AsyncSession, tenant_id: uuid.UUID | None = None
+    ) -> list[dict[str, Any]]:
         """Return UI manifests for all active plugins.
 
         Each entry contains the plugin name and its frontend UI contributions
         (menu_items, page_routes, detail_tabs, settings_pages, dashboard_widgets).
+
+        Audit P1 (tenant manifests): when *tenant_id* is given, plugins that are
+        deactivated for that tenant (tenant_plugin_activation.is_active=False)
+        are excluded — the manifest output must mirror require_active_plugin()
+        semantics so the UI never offers menus/routes the backend then blocks
+        with 403. No tenant row = default active (same as the API gate).
         """
         result = await db.execute(select(PluginModel).where(PluginModel.active.is_(True)))
         active_records = {row.name: row for row in result.scalars().all()}
 
+        # Per-tenant deactivations (same table/semantics as deps.require_active_plugin)
+        tenant_disabled: set[str] = set()
+        if tenant_id is not None:
+            from sqlalchemy import text as sa_text
+
+            rows = await db.execute(
+                sa_text(
+                    "SELECT plugin_name FROM tenant_plugin_activation "
+                    "WHERE tenant_id = :tid AND is_active = false"
+                ),
+                {"tid": tenant_id},
+            )
+            tenant_disabled = {row[0] for row in rows}
+
         manifests: list[dict[str, Any]] = []
         for name, plugin in self._plugins.items():
             if name not in active_records:
                 continue
+            if name in tenant_disabled:
+                continue
             m = plugin.manifest
             manifests.append(
                 {