refactor(b1): contacts domain fully plugin-owned - routes moved from core to contacts plugin with require_active_plugin guard

app/main.py

@@ -39,9 +39,6 @@ from app.routes import (  # noqa: E402
     compliance,
     backups,
     bank_accounts,
-    contact_folder_permissions,
-    contact_folders,
-    contacts,
     currencies,
     custom_field_definitions,
     custom_fields,
@@ -545,11 +542,9 @@ def create_app() -> FastAPI:
     app.include_router(groups.router)
     app.include_router(tenants.router)
     app.include_router(notifications.router)
-    from app.routes.companies import router as companies_router
-    app.include_router(companies_router)
-    app.include_router(contacts.router)
-    app.include_router(contact_folders.router)
-    app.include_router(contact_folder_permissions.router)
+    # NOTE: contacts/companies/contact-folders routes are plugin-owned now
+    # (Block B1) and mounted via the manifest.routes mechanism below with
+    # require_active_plugin("contacts") protection.
     app.include_router(entity_permissions.router)
     app.include_router(dashboard.router)
     app.include_router(entity_history.router)

app/plugins/builtins/contacts/plugin.py

@@ -9,25 +9,49 @@ from __future__ import annotations
 import logging
 
 from app.plugins.base import BasePlugin
-from app.plugins.manifest import PluginManifest
+from app.plugins.manifest import PluginManifest, PluginRouteDef
 
 logger = logging.getLogger(__name__)
 
 
 class ContactsPlugin(BasePlugin):
-    """Contacts plugin — manages Contact entity lifecycle (models, permissions, restore, history).
+    """Contacts plugin — owns the full Contact domain (Block B1).
 
-    Routes remain in app/routes/contacts.py as core routes, but entity lifecycle
-    (permissions, entity models, restore, history) is managed through on_activate/on_deactivate.
+    Routes (contacts, companies, contact folders, folder permissions) live in
+    this plugin and are mounted via manifest.routes with
+    require_active_plugin("contacts") protection. Entity lifecycle
+    (permissions, entity models, restore, history) is managed through
+    on_activate/on_deactivate like every other business plugin.
     """
 
     manifest = PluginManifest(
         name="contacts",
-        version="1.0.0",
+        version="1.1.0",
         display_name="Contacts",
         description="Core CRM contacts — persons and companies.",
         dependencies=[],
-        routes=[],  # Routes are registered as core routes in main.py
+        routes=[
+            PluginRouteDef(
+                path="/api/v1/contacts",
+                module="app.plugins.builtins.contacts.routes",
+                router_attr="router",
+            ),
+            PluginRouteDef(
+                path="/api/v1/companies",
+                module="app.plugins.builtins.contacts.company_routes",
+                router_attr="router",
+            ),
+            PluginRouteDef(
+                path="/api/v1/contact-folders",
+                module="app.plugins.builtins.contacts.folder_routes",
+                router_attr="router",
+            ),
+            PluginRouteDef(
+                path="/api/v1/contact-folders",
+                module="app.plugins.builtins.contacts.folder_permission_routes",
+                router_attr="router",
+            ),
+        ],
         events=[],
         migrations=[],
         permissions=[

app/routes/__init__.py

@@ -7,7 +7,6 @@ from app.routes import (
     compliance,  # noqa: F401
     auth,  # noqa: F401
     bank_accounts,  # noqa: F401
-    contacts,  # noqa: F401
     currencies,  # noqa: F401
     dashboard,  # noqa: F401
     entity_history,  # noqa: F401