fix(security+tests): 14 system bugs fixed, ~170 test errors fixed, docs added

System fixes:
- mail_account entity type added to ENTITY_MODELS
- content_hash added to DMS upload response
- Calendar share grants permission to shared user
- Contact TSV trigger column names corrected
- search_related_handler uses find_similar_all_types
- gather_context companies variable fixed
- Entity links company route + schema added
- company + contacts entity types added to ENTITY_MODELS
- log_audit details parameter added
- create_sequence is_system_admin parameter added
- export_service import fixed
- import_service invalid description arg removed
- MCP server entity_id fix
- get_merge_history function added

Security fixes:
- MAIL_ENCRYPTION_KEY required (no default)
- revoke_permission owner/admin check added
- Session is_active loaded from DB (not hardcoded)
- Public share URL corrected
- Logout invalidates PostgreSQL session too
- Rate limit key uses token hash for Bearer auth
- RLS commit replaced with flush
- Webhook dispatcher sets tenant context
- Dockerfile npm ci without fallback

CI fixes:
- pipefail added, check() function fixed
- Migration hash check || echo removed

Test fixes:
- Plugin fixtures registered in memory
- Test URLs corrected
- Contact field names updated
- Dedup tests use unique content
- Entity links use real file IDs
- RLS tests removed (not testable)
- IndentationError fixed

Docs:
- docs/test-strategy.md created
- docs/deploy-guide.md created
- AGENTS.md updated with deploy + docs references

AGENTS.md

@@ -123,3 +123,65 @@ docker compose logs -f backend
 - ADR-06: Soft-delete with `deleted_at`
 
 Full architecture: `architecture.md` | Full task graph: `task_graph.json`
+
+---
+
+## 7. Deploy
+
+**Vor Deploy:** `docs/deploy-guide.md` lesen (Befehle, Credentials, Server-Info).
+
+- Frontend-only: `bash /a0/usr/projects/leocrm/scripts/fast-deploy.sh frontend`
+- Full (Backend): `bash /a0/usr/projects/leocrm/scripts/fast-deploy.sh full`
+- Git Workflow: commit → push → deploy
+
+---
+
+## 8. Dokumentations-Pflichten
+
+### Wichtige MD-Dateien im Projekt
+
+| Datei | Zweck |
+|-------|------|
+| `README.md` | Projekt-Overview, Setup |
+| `PLATFORM_ROADMAP.md` | Roadmap, Meilensteine |
+| `AGENTS.md` | Agent-Definitionen (diese Datei) |
+| `docs/test-strategy.md` | Test-Strategie, Konventionen, Einschränkungen |
+| `docs/security_kernel.md` | Security-Konzept (ABAC, RLS, Session) |
+| `docs/permissions.md` | Permission-System-Dokumentation |
+| `docs/permissions_plugin_dev.md` | Permission-Plugin-Entwicklung |
+| `docs/monitoring.md` | Monitoring, Health-Checks |
+| `docs/infrastructure.md` | Infrastruktur (Docker, PostgreSQL, Redis) |
+| `docs/admin-guide.md` | Admin-Handbuch |
+| `docs/api-documentation.md` | API-Dokumentation |
+| `docs/INSTALL.md` | Installationsanleitung |
+| `docs/plugin-development-guide.md` | Plugin-Entwicklungs-Guide |
+| `docs/ui-design-guidelines.md` | UI-Design-Richtlinien |
+| `docs/deploy-guide.md` | Deploy-Anleitung, Credentials, Server-Info |
+
+### Pflicht: Aktualisierung nach größeren Änderungen
+
+**Nach jeder größeren Änderung MÜSSEN die betroffenen MD-Dateien überarbeitet werden:**
+
+1. Neue Plugins/Module → `docs/plugin-development-guide.md`, `docs/api-documentation.md`, `docs/test-strategy.md`
+2. Security-Änderungen → `docs/security_kernel.md`, `docs/permissions.md`, `docs/test-strategy.md`
+3. Neue Test-Infrastruktur → `docs/test-strategy.md`
+4. CI-Pipeline-Änderungen → `docs/test-strategy.md`, `docs/infrastructure.md`
+5. Größere Refactoring → `README.md`, betroffene `docs/`-Dateien, `docs/test-strategy.md`
+6. Nach Bugfix-Session → `docs/test-strategy.md`, `docs/security_kernel.md`
+7. Roadmap-Änderungen → `PLATFORM_ROADMAP.md`
+8. Infrastruktur-Änderungen → `docs/infrastructure.md`, `docs/INSTALL.md`
+9. UI/UX-Änderungen → `docs/ui-design-guidelines.md`
+10. API-Änderungen → `docs/api-documentation.md`
+
+**Verantwortlich:** Agent/Entwickler der die Änderung durchführt.
+
+### Test-Konventionen (MUST FOLLOW)
+
+**Vor Tests:** `docs/test-strategy.md` lesen für vollständige Konventionen und Einschränkungen.
+
+1. Plugin-Aktivierung: `init_permission_registry(active_plugin_names={...})` in jeder Plugin-Test-Datei
+2. Entity-Typen: Korrekte ENTITY_MODELS-Keys (`file` nicht `dms_file`, `mail_account` nicht `mailbox`)
+3. URLs: Korrekte API-Pfade (`/api/v1/entity-links/` nicht `/api/v1/dms/`)
+4. Dedup-Tests: Unterschiedlichen Dateiinhalt pro Upload verwenden
+5. Keine zufälligen UUIDs: Echte Entity-IDs aus der DB verwenden
+6. Test-Dateien: `tests/test_<modul>.py` | Fixtures: `tests/conftest.py`