fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

Verifikation: Alle 17 Audit-Findings gegen den Code geprueft — alle bestaetigt.
Backend-Lifecycle-Fixes umgesetzt; 4 Frontend-Plugin-Architektur-Punkte
als Phase Q in die Roadmap eingeplant.

- P1 list_workspaces: Module + User-Counts gebuendelt laden (Editor-Overwrite-Bug)
- P1 active-manifests: Tenant-Deaktivierung (tenant_plugin_activation) filtern
- P1 uninstall: volle Service-Deactivation VOR registry.uninstall()
- P1 ContractRegistry: DB-Aktivstatus-Guard (Restart-Edge-Case) + Re-Activate
- P1/P2 Field-Definitions: voller Lifecycle (register/unregister) im Service
- P1/P2 Contact-Felddefinitionen (39) ins ContactsPlugin-Manifest verschoben
- P1 12 fehlende Permission-Keys registriert (AST-Scan: 0 fehlend)
- P2 contact_folder -> ContactsPlugin; ENTITY_PLUGIN_OWNERS wird befuellt
- P2 Entity-Permission-Fallback fail-closed statt contacts:read
- P2 forgejo_error_reporter is_core=False; DMS is_core=True (ADR-020)
- P2 Worker: Contacts-Trash-Cleanup ins Plugin (get_job_modules-Discovery)
- P1/P2 DSGVO-Export delegiert an DSAR-Collector (kein Core->Contacts)
- P2 False-green Tests korrigiert (or True, veraltete Route-Count-Assertion)

Verifikation: tests/test_audit_architecture_fixes.py 17/17; Regressionen
gruen (contacts_lifecycle, entity_registry, workspace_scopes, rbac,
lifecycle_service); Combo-Order-Test 35/35; Cross-Plugin-Checker 497/0;
compileall sauber; ruff auf 7-Error-Baseline.

Doku: PROGRESS.md Audit-Section, PLATFORM_ROADMAP.md Phase Q (Q1-Q4),
plugin-development-guide.md Lifecycle, permissions.md Katalog.

app/routes/plugins.py

@@ -58,9 +58,21 @@ async def get_active_manifests(
     dashboard_widgets contributed by each active plugin. Used by the
     frontend PluginRegistry to dynamically register routes, sidebar items,
     settings pages, and detail tabs.
+
+    Audit P1 (tenant manifests): plugins deactivated for the caller's
+    tenant are excluded so UI and API gates agree (no 403-on-click menus).
     """
+    import uuid as uuid_mod
+
     service = get_plugin_service()
-    manifests = await service.get_active_manifests(db)
+    tenant_id: uuid_mod.UUID | None = None
+    raw_tid = current_user.get("tenant_id")
+    if raw_tid:
+        try:
+            tenant_id = uuid_mod.UUID(str(raw_tid))
+        except (ValueError, TypeError):
+            tenant_id = None
+    manifests = await service.get_active_manifests(db, tenant_id=tenant_id)
     return {"plugins": manifests, "total": len(manifests)}
 
 

app/routes/system_settings.py

@@ -192,25 +192,20 @@ async def dsgvo_export(
 ):
     """Export all personal data for a user (DSGVO/GDPR data subject access request).
 
-    Returns a JSON file with all data associated with the user:
-    - User profile
-    - Contacts owned by user
-    - Audit log entries
-    - Mail accounts
-    - Tasks assigned to user
-    - Calendar events
-    - Communication messages
+    Audit P1/P2 (DSGVO duplicate): this route previously held a second,
+    contact-aware export implementation parallel to the newer DSAR job
+    pipeline. It now delegates to the single authoritative collector
+    ``app.core.jobs._dsar_collect_user_data`` — core-owned categories are
+    collected there, plugin-owned categories (contacts, mail, tasks,
+    calendar, communication, ...) are contributed by the plugin contracts.
+    No core->contacts coupling here anymore.
     """
     import io
     import json
-    from datetime import UTC, datetime
 
     from fastapi.responses import StreamingResponse
-    from sqlalchemy import select as sa_select
 
-    from app.models.audit import AuditLog
-    from app.models.contact import Contact
-    from app.models.user import User
+    from app.core.jobs import _dsar_collect_user_data
 
     tenant_id = uuid.UUID(current_user["tenant_id"])
     try:
@@ -218,34 +213,7 @@ async def dsgvo_export(
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid user_id", "code": "invalid_id"}) from None
 
-    export_data = {"user_id": str(uid), "exported_at": datetime.now(UTC).isoformat(), "data": {}}
-
-    # User profile
-    user_result = await db.execute(sa_select(User).where(User.id == uid))
-    user = user_result.scalar_one_or_none()
-    if user:
-        export_data["data"]["profile"] = {
-            "email": user.email, "name": user.name, "role": user.role,
-            "is_active": user.is_active, "created_at": user.created_at.isoformat() if user.created_at else None,
-        }
-
-    # Contacts owned by user
-    contacts_result = await db.execute(
-        sa_select(Contact).where(Contact.tenant_id == tenant_id, Contact.owner_id == uid, Contact.deleted_at.is_(None))
-    )
-    export_data["data"]["contacts"] = [
-        {"id": str(c.id), "type": c.type, "displayname": c.displayname, "email_1": c.email_1, "email_2": c.email_2}
-        for c in contacts_result.scalars().all()
-    ]
-
-    # Audit log entries
-    audit_result = await db.execute(
-        sa_select(AuditLog).where(AuditLog.tenant_id == tenant_id, AuditLog.user_id == uid).limit(1000)
-    )
-    export_data["data"]["audit_log"] = [
-        {"action": a.action, "entity_type": a.entity_type, "timestamp": a.timestamp.isoformat() if a.timestamp else None}
-        for a in audit_result.scalars().all()
-    ]
+    export_data = await _dsar_collect_user_data(db, str(tenant_id), str(uid))
 
     # Log the DSGVO export
     from app.core.audit import log_audit