fix(arch): externes Audit — 13 Backend-Fixes (Workspace-Modules, Tenant-Manifeste, Lifecycle, Contracts, Permissions)

Verifikation: Alle 17 Audit-Findings gegen den Code geprueft — alle bestaetigt.
Backend-Lifecycle-Fixes umgesetzt; 4 Frontend-Plugin-Architektur-Punkte
als Phase Q in die Roadmap eingeplant.

- P1 list_workspaces: Module + User-Counts gebuendelt laden (Editor-Overwrite-Bug)
- P1 active-manifests: Tenant-Deaktivierung (tenant_plugin_activation) filtern
- P1 uninstall: volle Service-Deactivation VOR registry.uninstall()
- P1 ContractRegistry: DB-Aktivstatus-Guard (Restart-Edge-Case) + Re-Activate
- P1/P2 Field-Definitions: voller Lifecycle (register/unregister) im Service
- P1/P2 Contact-Felddefinitionen (39) ins ContactsPlugin-Manifest verschoben
- P1 12 fehlende Permission-Keys registriert (AST-Scan: 0 fehlend)
- P2 contact_folder -> ContactsPlugin; ENTITY_PLUGIN_OWNERS wird befuellt
- P2 Entity-Permission-Fallback fail-closed statt contacts:read
- P2 forgejo_error_reporter is_core=False; DMS is_core=True (ADR-020)
- P2 Worker: Contacts-Trash-Cleanup ins Plugin (get_job_modules-Discovery)
- P1/P2 DSGVO-Export delegiert an DSAR-Collector (kein Core->Contacts)
- P2 False-green Tests korrigiert (or True, veraltete Route-Count-Assertion)

Verifikation: tests/test_audit_architecture_fixes.py 17/17; Regressionen
gruen (contacts_lifecycle, entity_registry, workspace_scopes, rbac,
lifecycle_service); Combo-Order-Test 35/35; Cross-Plugin-Checker 497/0;
compileall sauber; ruff auf 7-Error-Baseline.

Doku: PROGRESS.md Audit-Section, PLATFORM_ROADMAP.md Phase Q (Q1-Q4),
plugin-development-guide.md Lifecycle, permissions.md Katalog.

tests/test_rbac_comprehensive.py

@@ -411,12 +411,35 @@ class TestPermissionRegistryUnit:
         assert mail_defs[0]["field"] == "subject"
 
     def test_get_all_field_definitions_includes_core(self):
-        """get_all_field_definitions() includes core field definitions."""
+        """get_all_field_definitions() includes core field definitions.
+
+        Audit P1/P2: contacts:* field definitions moved to the ContactsPlugin
+        manifest — the core keeps only core-owned fields (users). Plugin
+        definitions join via register_field_definitions() (full lifecycle:
+        register/unregister).
+        """
         reg = PermissionRegistry()
         reg.initialize()
         all_defs = reg.get_all_field_definitions()
+        user_defs = [d for d in all_defs if d.get("module") == "users"]
+        assert len(user_defs) > 0
+        # Contacts are plugin-owned now — nothing in the core list
         contact_defs = [d for d in all_defs if d.get("module") == "contacts"]
-        assert len(contact_defs) > 0
+        assert contact_defs == []
+
+        # Plugin definitions appear once registered ...
+        reg.register_field_definitions("contacts", [
+            {"module": "contacts", "field": "firstname", "label": "First Name", "sensitivity": "normal"},
+        ])
+        all_defs = reg.get_all_field_definitions()
+        contact_defs = [d for d in all_defs if d.get("module") == "contacts"]
+        assert len(contact_defs) == 1
+        # ... and disappear on unregister (audit: contribution fully
+        # lifecycle-integrated)
+        reg.unregister_field_definitions("contacts")
+        all_defs = reg.get_all_field_definitions()
+        contact_defs = [d for d in all_defs if d.get("module") == "contacts"]
+        assert contact_defs == []
 
 
 # ═══════════════════════════════════════════════════════════════