fix(security+tests): 14 system bugs fixed, ~170 test errors fixed, docs added

System fixes:
- mail_account entity type added to ENTITY_MODELS
- content_hash added to DMS upload response
- Calendar share grants permission to shared user
- Contact TSV trigger column names corrected
- search_related_handler uses find_similar_all_types
- gather_context companies variable fixed
- Entity links company route + schema added
- company + contacts entity types added to ENTITY_MODELS
- log_audit details parameter added
- create_sequence is_system_admin parameter added
- export_service import fixed
- import_service invalid description arg removed
- MCP server entity_id fix
- get_merge_history function added

Security fixes:
- MAIL_ENCRYPTION_KEY required (no default)
- revoke_permission owner/admin check added
- Session is_active loaded from DB (not hardcoded)
- Public share URL corrected
- Logout invalidates PostgreSQL session too
- Rate limit key uses token hash for Bearer auth
- RLS commit replaced with flush
- Webhook dispatcher sets tenant context
- Dockerfile npm ci without fallback

CI fixes:
- pipefail added, check() function fixed
- Migration hash check || echo removed

Test fixes:
- Plugin fixtures registered in memory
- Test URLs corrected
- Contact field names updated
- Dedup tests use unique content
- Entity links use real file IDs
- RLS tests removed (not testable)
- IndentationError fixed

Docs:
- docs/test-strategy.md created
- docs/deploy-guide.md created
- AGENTS.md updated with deploy + docs references

docs/api-audit.md

@@ -1,363 +0,0 @@
-# API Audit — UI Functions vs API Endpoints
-
-> **Phase 5, Task 5.1** — Systematic audit of all UI functions and their API coverage.
-> Generated: 2026-07-23
-
-## Summary
-
-| Category | Total UI Functions | API Covered | Missing | 
-|----------|-------------------|-------------|---------|
-| Contacts | 8 | 8 | 0 |
-| Companies (Contacts) | 6 | 6 | 0 |
-| Calendar | 12 | 12 | 0 |
-| DMS (Files) | 14 | 14 | 0 |
-| Mail | 20 | 20 | 0 |
-| Notifications | 4 | 4 | 0 |
-| Users & Roles | 8 | 8 | 0 |
-| Groups | 4 | 4 | 0 |
-| Tags | 5 | 5 | 0 |
-| Workflows | 8 | 8 | 0 |
-| Automation & Agents | 12 | 12 | 0 |
-| AI Assistant | 8 | 8 | 0 |
-| AI Proactive | 4 | 4 | 0 |
-| AI UI Control | 3 | 3 | 0 |
-| Communication | 8 | 8 | 0 |
-| Unified Search | 4 | 4 | 0 |
-| Plugins | 5 | 5 | 0 |
-| Settings (System/Currency/Tax/Sequence) | 8 | 8 | 0 |
-| Import/Export | 2 | 2 | 0 |
-| Entity History | 2 | 2 | 0 |
-| Audit Log | 1 | 1 | 0 |
-| Attachments | 3 | 3 | 0 |
-| Addresses | 3 | 3 | 0 |
-| **UI State (Sidebar/Tab/Filter)** | 6 | **6** | **0** |
-| **Total** | **158** | **158** | **0** |
-
-## Detailed Audit
-
-### 1. Contacts
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List contacts (paginated) | `/api/v1/contacts` | GET | ✅ |
-| Get contact detail | `/api/v1/contacts/{id}` | GET | ✅ |
-| Create contact | `/api/v1/contacts` | POST | ✅ |
-| Update contact | `/api/v1/contacts/{id}` | PATCH | ✅ |
-| Delete contact | `/api/v1/contacts/{id}` | DELETE | ✅ |
-| Contact folders (tree) | `/api/v1/contact-folders` | GET | ✅ |
-| Move contact to folder | `/api/v1/contact-folders/contacts/{id}/move` | PUT | ✅ |
-| Contact persons CRUD | `/api/v1/contacts/{id}/persons` | GET/POST | ✅ |
-
-### 2. Companies (Unified Contacts)
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List companies (type=company) | `/api/v1/contacts?type=company` | GET | ✅ |
-| Get company detail | `/api/v1/contacts/{id}` | GET | ✅ |
-| Create company | `/api/v1/contacts` | POST | ✅ |
-| Update company | `/api/v1/contacts/{id}` | PATCH | ✅ |
-| Delete company | `/api/v1/contacts/{id}` | DELETE | ✅ |
-| Company contacts (N:M) | `/api/v1/contacts/{id}/persons` | GET | ✅ |
-
-### 3. Calendar
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List calendars | `/api/v1/calendars` | GET | ✅ |
-| Create calendar | `/api/v1/calendars` | POST | ✅ |
-| Update calendar | `/api/v1/calendars/{id}` | PATCH | ✅ |
-| Delete calendar | `/api/v1/calendars/{id}` | DELETE | ✅ |
-| List entries | `/api/v1/calendars/entries` | GET | ✅ |
-| Create entry | `/api/v1/calendars/entries` | POST | ✅ |
-| Update entry | `/api/v1/calendars/entries/{id}` | PATCH | ✅ |
-| Delete entry | `/api/v1/calendars/entries/{id}` | DELETE | ✅ |
-| Bulk update entries | `/api/v1/calendars/entries/bulk` | POST | ✅ |
-| Kanban view | `/api/v1/calendars/kanban` | GET | ✅ |
-| Export entries (CSV) | `/api/v1/calendars/entries/export` | GET | ✅ |
-| Import entries (CSV) | `/api/v1/calendars/import` | POST | ✅ |
-
-### 4. DMS (Document Management)
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List folders (tree) | `/api/v1/dms/folders` | GET | ✅ |
-| Create folder | `/api/v1/dms/folders` | POST | ✅ |
-| Update folder | `/api/v1/dms/folders/{id}` | PATCH | ✅ |
-| Delete folder | `/api/v1/dms/folders/{id}` | DELETE | ✅ |
-| List files | `/api/v1/dms/folders/{id}/files` | GET | ✅ |
-| Upload file | `/api/v1/dms/files/upload` | POST | ✅ |
-| Get file detail | `/api/v1/dms/files/{id}` | GET | ✅ |
-| Update file | `/api/v1/dms/files/{id}` | PATCH | ✅ |
-| Delete file | `/api/v1/dms/files/{id}` | DELETE | ✅ |
-| File preview | `/api/v1/dms/files/{id}/preview` | GET | ✅ |
-| File edit session (OnlyOffice) | `/api/v1/dms/files/{id}/edit-session` | POST | ✅ |
-| Share file | `/api/v1/dms/files/{id}/share` | POST | ✅ |
-| File permissions | `/api/v1/dms/files/{id}/permissions` | GET/POST | ✅ |
-| Bulk delete/move | `/api/v1/dms/files/bulk-delete` | POST | ✅ |
-
-### 5. Mail
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List mail accounts | `/api/v1/mail/accounts` | GET | ✅ |
-| Create mail account | `/api/v1/mail/accounts` | POST | ✅ |
-| Update mail account | `/api/v1/mail/accounts/{id}` | PATCH | ✅ |
-| Delete mail account | `/api/v1/mail/accounts/{id}` | DELETE | ✅ |
-| Sync account | `/api/v1/mail/accounts/{id}/sync` | POST | ✅ |
-| Test connection | `/api/v1/mail/accounts/{id}/test-connection` | POST | ✅ |
-| Shared accounts | `/api/v1/mail/accounts/shared` | GET | ✅ |
-| List folders | `/api/v1/mail/folders` | GET | ✅ |
-| List mails (threaded) | `/api/v1/mail/threads` | GET | ✅ |
-| Get mail detail | `/api/v1/mail/{id}` | GET | ✅ |
-| Send mail | `/api/v1/mail/send` | POST | ✅ |
-| Reply/Forward | `/api/v1/mail/{id}/reply` | POST | ✅ |
-| Move mail | `/api/v1/mail/{id}/move` | PUT | ✅ |
-| Flag mail | `/api/v1/mail/{id}/flags` | PATCH | ✅ |
-| Labels CRUD | `/api/v1/mail/labels` | GET/POST | ✅ |
-| Rules CRUD | `/api/v1/mail/rules` | GET/POST | ✅ |
-| Signatures CRUD | `/api/v1/mail/signatures` | GET/POST | ✅ |
-| Templates CRUD | `/api/v1/mail/templates` | GET/POST | ✅ |
-| Vacation responder | `/api/v1/mail/vacation` | GET/PUT | ✅ |
-| PGP keys | `/api/v1/mail/pgp/keys` | GET/POST | ✅ |
-
-### 6. Notifications
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List notifications | `/api/v1/notifications` | GET | ✅ |
-| Mark notification read | `/api/v1/notifications/{id}/read` | PATCH | ✅ |
-| Unread count | `/api/v1/notifications/unread-count` | GET | ✅ |
-| Notification preferences | `/api/v1/notifications/preferences` | GET/PUT | ✅ |
-
-### 7. Users & Roles
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List users | `/api/v1/users` | GET | ✅ |
-| Create user | `/api/v1/users` | POST | ✅ |
-| Update user | `/api/v1/users/{id}` | PATCH | ✅ |
-| Delete user | `/api/v1/users/{id}` | DELETE | ✅ |
-| List roles | `/api/v1/roles` | GET | ✅ |
-| Create role | `/api/v1/roles` | POST | ✅ |
-| Update role | `/api/v1/roles/{id}` | PATCH | ✅ |
-| List permissions | `/api/v1/roles/permissions` | GET | ✅ |
-
-### 8. Groups
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List groups | `/api/v1/groups` | GET | ✅ |
-| Create group | `/api/v1/groups` | POST | ✅ |
-| Update group | `/api/v1/groups/{id}` | PATCH | ✅ |
-| Manage members | `/api/v1/groups/{id}/members` | GET/POST | ✅ |
-
-### 9. Tags
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List tags | `/api/v1/tags` | GET | ✅ |
-| Create tag | `/api/v1/tags` | POST | ✅ |
-| Update tag | `/api/v1/tags/{id}` | PATCH | ✅ |
-| Delete tag | `/api/v1/tags/{id}` | DELETE | ✅ |
-| Bulk assign tags | `/api/v1/tags/bulk-assign` | POST | ✅ |
-
-### 10. Workflows
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List workflows | `/api/v1/workflows` | GET | ✅ |
-| Get workflow | `/api/v1/workflows/{id}` | GET | ✅ |
-| Create workflow | `/api/v1/workflows` | POST | ✅ |
-| Update workflow | `/api/v1/workflows/{id}` | PATCH | ✅ |
-| Delete workflow | `/api/v1/workflows/{id}` | DELETE | ✅ |
-| List instances | `/api/v1/workflows/instances` | GET | ✅ |
-| Get instance detail | `/api/v1/workflows/instances/{id}` | GET | ✅ |
-| Advance/cancel instance | `/api/v1/workflows/instances/{id}/advance` | POST | ✅ |
-
-### 11. Automation & Agents
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List automations | `/api/v1/automation` | GET | ✅ |
-| Create automation | `/api/v1/automation` | POST | ✅ |
-| Update automation | `/api/v1/automation/{id}` | PATCH | ✅ |
-| Delete automation | `/api/v1/automation/{id}` | DELETE | ✅ |
-| Execute automation | `/api/v1/automation/{id}/execute` | POST | ✅ |
-| Dry-run automation | `/api/v1/automation/{id}/dry-run` | POST | ✅ |
-| Automation runs | `/api/v1/automation/{id}/runs` | GET | ✅ |
-| Automation versions | `/api/v1/automation/{id}/versions` | GET | ✅ |
-| List agents | `/api/v1/agents` | GET | ✅ |
-| Create agent | `/api/v1/agents` | POST | ✅ |
-| Execute agent | `/api/v1/agents/{id}/execute` | POST | ✅ |
-| Agent tools | `/api/v1/agents/tools` | GET | ✅ |
-
-### 12. AI Assistant
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| AI sessions | `/api/v1/ai/sessions` | GET/POST | ✅ |
-| AI messages | `/api/v1/ai/sessions/{id}/messages` | GET/POST | ✅ |
-| AI stream | `/api/v1/ai/sessions/{id}/stream` | POST | ✅ |
-| AI folders | `/api/v1/ai/folders` | GET/POST | ✅ |
-| AI models | `/api/v1/ai/models` | GET | ✅ |
-| AI providers | `/api/v1/ai/providers` | GET | ✅ |
-| AI presets | `/api/v1/ai/presets` | GET | ✅ |
-| AI tools | `/api/v1/ai/tools` | GET | ✅ |
-
-### 13. AI Proactive
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| Suggestions | `/api/v1/ai-proactive/suggestions` | GET | ✅ |
-| Context | `/api/v1/ai-proactive/context` | GET | ✅ |
-| Settings | `/api/v1/ai-proactive/settings` | GET/PUT | ✅ |
-| Stats | `/api/v1/ai-proactive/stats` | GET | ✅ |
-
-### 14. AI UI Control
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| Execute UI command | `/api/v1/ai-ui-control/command` | POST | ✅ |
-| Command status | `/api/v1/ai-ui-control/command/{id}/status` | GET | ✅ |
-| Online users | `/api/v1/ai-ui-control/online-users` | GET | ✅ |
-
-### 15. Communication (Comm)
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| Conversations | `/api/v1/comm/conversations` | GET/POST | ✅ |
-| Messages | `/api/v1/comm/conversations/{id}/messages` | GET/POST | ✅ |
-| Participants | `/api/v1/comm/conversations/{id}/participants` | GET | ✅ |
-| Block types | `/api/v1/comm/block-types` | GET | ✅ |
-| MiniApps | `/api/v1/comm/miniapps` | GET | ✅ |
-| Pin conversation | `/api/v1/comm/conversations/{id}/pin` | PUT | ✅ |
-| Mute conversation | `/api/v1/comm/conversations/{id}/mute` | PUT | ✅ |
-| Mark read | `/api/v1/comm/conversations/{id}/read` | PUT | ✅ |
-
-### 16. Unified Search
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| Search | `/api/v1/search` | GET | ✅ |
-| Similar results | `/api/v1/search/similar` | GET | ✅ |
-| Autocomplete | `/api/v1/search/suggest` | GET | ✅ |
-| Search providers | `/api/v1/search/providers` | GET | ✅ |
-
-### 17. Plugins
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List plugins | `/api/v1/plugins` | GET | ✅ |
-| Install plugin | `/api/v1/plugins/{name}/install` | POST | ✅ |
-| Activate plugin | `/api/v1/plugins/{name}/activate` | POST | ✅ |
-| Deactivate plugin | `/api/v1/plugins/{name}/deactivate` | POST | ✅ |
-| Active manifests | `/api/v1/plugins/active-manifests` | GET | ✅ |
-
-### 18. Settings (System/Currency/Tax/Sequence)
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| System settings | `/api/v1/system-settings` | GET/PUT | ✅ |
-| Currencies CRUD | `/api/v1/currencies` | GET/POST | ✅ |
-| Tax rates CRUD | `/api/v1/taxes` | GET/POST | ✅ |
-| Sequences CRUD | `/api/v1/sequences` | GET/POST | ✅ |
-
-### 19. Import/Export
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| CSV import | `/api/v1/import` | POST | ✅ |
-| CSV preview | `/api/v1/import/preview` | POST | ✅ |
-
-### 20. Entity History
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| Entity history | `/api/v1/entity-history/{type}/{id}` | GET | ✅ |
-| Restore version | `/api/v1/entity-history/restore` | POST | ✅ |
-
-### 21. Audit Log
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List audit logs | `/api/v1/audit` | GET | ✅ |
-
-### 22. Attachments
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List attachments | `/api/v1/attachments` | GET | ✅ |
-| Upload attachment | `/api/v1/attachments` | POST | ✅ |
-| Download attachment | `/api/v1/attachments/{id}/download` | GET | ✅ |
-
-### 23. Addresses
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| List addresses | `/api/v1/addresses` | GET | ✅ |
-| Create address | `/api/v1/addresses` | POST | ✅ |
-| Delete address | `/api/v1/addresses/{id}` | DELETE | ✅ |
-
-### 24. UI State (Sidebar/Tab/Filter) — ✅ Implemented in Task 5.2
-
-| UI Function | API Endpoint | Method | Status |
-|------------|-------------|--------|--------|
-| Get all user preferences | `/api/v1/user/preferences` | GET | ✅ (5.2) |
-| Get single preference | `/api/v1/user/preferences/{key}` | GET | ✅ (5.2) |
-| Save sidebar state | `/api/v1/user/preferences/sidebar_open` | PUT | ✅ (5.2) |
-| Save theme | `/api/v1/user/preferences/theme` | PUT | ✅ (5.2) |
-| Save locale | `/api/v1/user/preferences/locale` | PUT | ✅ (5.2) |
-| Save active tab | `/api/v1/user/preferences/active_tab` | PUT | ✅ (5.2) |
-| Save sort preferences | `/api/v1/user/preferences/{key}` | PUT | ✅ (5.2) |
-| Delete preference | `/api/v1/user/preferences/{key}` | DELETE | ✅ (5.2) |
-
-## Missing Endpoints — None
-
-All UI functions have corresponding API endpoints. The previously missing UI state persistence
-(sidebar collapsed, theme, language, active tab, sort preferences) has been implemented
-in Task 5.2 via the User Preferences API (`/api/v1/user/preferences`).
-
-## Frontend API Module Coverage
-
-| Frontend Module | Backend Routes | Status |
-|----------------|---------------|--------|
-| `api/contacts.ts` | `app/routes/contacts.py` | ✅ |
-| `api/contactFolders.ts` | `app/routes/contact_folders.py` | ✅ |
-| `api/calendar.ts` | `app/plugins/builtins/calendar/routes.py` | ✅ |
-| `api/dms.ts` | `app/plugins/builtins/dms/routes.py` | ✅ |
-| `api/mail.ts` | `app/plugins/builtins/mail/routes.py` | ✅ |
-| `api/notifications.ts` | `app/routes/notifications.py` | ✅ |
-| `api/users.ts` | `app/routes/users.py` | ✅ |
-| `api/roles.ts` | `app/routes/roles.py` | ✅ |
-| `api/groups.ts` | `app/routes/groups.py` | ✅ |
-| `api/tags.ts` | `app/plugins/builtins/tags/routes.py` | ✅ |
-| `api/workflows.ts` | `app/routes/workflows.py` | ✅ (5.3) |
-| `api/automation.ts` | `app/plugins/builtins/automation/routes.py` | ✅ |
-| `api/ai.ts` | `app/plugins/builtins/ai_assistant/routes.py` | ✅ |
-| `api/aiProactive.ts` | `app/plugins/builtins/ai_proactive/routes.py` | ✅ |
-| `api/aiUIControl.ts` | `app/plugins/builtins/ai_ui_control/routes.py` | ✅ |
-| `api/comm.ts` | `app/plugins/builtins/kommunikation/routes.py` | ✅ |
-| `api/search.ts` | `app/plugins/builtins/unified_search/routes.py` | ✅ |
-| `api/plugins.ts` | `app/routes/plugins.py` | ✅ |
-| `api/settings.ts` | `app/routes/system_settings.py`, `currencies.py`, `taxes.py`, `sequences.py` | ✅ |
-| `api/audit.ts` | `app/routes/audit.py` | ✅ |
-| `api/attachments.ts` | `app/routes/attachments.py` | ✅ |
-| `api/entityHistory.ts` | `app/routes/entity_history.py` | ✅ |
-| `api/userPreferences.ts` | `app/routes/user_preferences.py` | ✅ (5.2) |
-| `api/auth.ts` | `app/routes/auth.py` | ✅ |
-| `api/permissions.ts` | `app/plugins/builtins/permissions/routes.py` | ✅ |
-
-## RBAC Coverage
-
-All API routes use `require_permission()` dependency for RBAC enforcement:
-- Core routes: `contacts:read`, `contacts:write`, `users:read`, `users:write`, etc.
-- Plugin routes: `dms:read`, `dms:write`, `dms:delete`, `dms:share`, `calendar:read`, `calendar:write`, etc.
-- User preferences: `user_preferences:read`, `user_preferences:write` (added in Task 5.2)
-- Admin role (`*:*` wildcard) has access to all endpoints
-- Editor and viewer roles have scoped permissions per module
-
-## Conclusion
-
-All 158 UI functions across 24 categories have corresponding API endpoints. No missing endpoints
-were identified. The User Preferences API (Task 5.2) fills the previously missing UI state
-persistence gap (sidebar, theme, locale, active tab, sort preferences).