Phase 1: Fix all critical release blockers (B1-B10)

B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports

Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.

app/deps.py

@@ -224,3 +224,34 @@ async def get_current_user_id(
 ) -> uuid.UUID:
     """Extract user_id from current user session."""
     return uuid.UUID(current_user["user_id"])
+
+
+def require_active_plugin(plugin_name: str):
+    """FastAPI dependency factory: require that a plugin is active.
+
+    Returns 403 if the plugin is not active in the permission registry.
+    This allows routes to be registered at app creation time while
+    enforcing activation status at request time.
+    """
+    async def _check(
+        current_user: dict[str, Any] = Depends(get_current_user),
+    ) -> dict[str, Any]:
+        from app.core.permission_registry import get_permission_registry
+        try:
+            registry = get_permission_registry()
+            if not registry.is_plugin_active(plugin_name):
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail={
+                        "detail": f"Plugin '{plugin_name}' is not active",
+                        "code": "plugin_inactive",
+                    },
+                )
+        except HTTPException:
+            raise
+        except Exception:
+            # If registry not initialized yet, allow request (startup race)
+            pass
+        return current_user
+
+    return _check