Phase 1: Fix all critical release blockers (B1-B10)

B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports

Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.

app/plugins/builtins/ai_assistant/routes.py

@@ -698,7 +698,7 @@ ATTACHMENT_DIR = Path(os.environ.get("STORAGE_PATH", "/data/storage")) / "ai_att
 MAX_ATTACHMENT_SIZE = 25 * 1024 * 1024  # 25MB
 
 
-@router.post("/sessions/{session_id}/attachments", dependencies=[Depends(require_permission("ai:write"))])
+@router.post("/sessions/{session_id}/attachments", response_model=None, dependencies=[Depends(require_permission("ai:write"))])
 async def upload_attachment(
     session_id: str,
     file: UploadFile,

app/plugins/builtins/calendar/routes.py

@@ -820,7 +820,7 @@ async def ics_feed(
     return Response(content=ics_content, media_type="text/calendar")
 
 
-@router.post("/calendar/import", dependencies=[Depends(require_permission("calendar:write"))])
+@router.post("/calendar/import", response_model=None, dependencies=[Depends(require_permission("calendar:write"))])
 async def import_ics(
     file: UploadFile = File(...),
     calendar_id: str | None = None,

app/plugins/builtins/dms/routes.py

@@ -417,7 +417,7 @@ async def delete_folder(
 # ─── Files ───
 
 
-@router.post("/files/upload", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("dms:write"))])
+@router.post("/files/upload", status_code=status.HTTP_201_CREATED, response_model=None, dependencies=[Depends(require_permission("dms:write"))])
 async def upload_file(
     file: UploadFile = File(...),
     folder_id: str | None = Form(None),
@@ -441,35 +441,35 @@ async def upload_file(
         if folder_result.scalar_one_or_none() is None:
             raise HTTPException(404, detail={"detail": "Folder not found", "code": "not_found"})
 
-    # Stream file in chunks — avoid loading entire file into RAM
+    # Stream file to storage — avoid loading entire file into RAM
     import hashlib
     CHUNK_SIZE = 1024 * 1024  # 1MB chunks
     sha256 = hashlib.sha256()
     file_size = 0
-    chunks: list[bytes] = []
 
-    while True:
-        chunk = await file.read(CHUNK_SIZE)
-        if not chunk:
-            break
-        file_size += len(chunk)
-        if file_size > MAX_FILE_SIZE:
-            raise HTTPException(
-                413, detail={"detail": "File too large (max 100MB)", "code": "file_too_large"}
-            )
-        sha256.update(chunk)
-        chunks.append(chunk)
-
-    content_hash = sha256.hexdigest()
+    async def chunk_stream():
+        nonlocal file_size
+        while True:
+            chunk = await file.read(CHUNK_SIZE)
+            if not chunk:
+                break
+            file_size += len(chunk)
+            if file_size > MAX_FILE_SIZE:
+                raise HTTPException(
+                    413, detail={"detail": "File too large (max 100MB)", "code": "file_too_large"}
+                )
+            sha256.update(chunk)
+            yield chunk
 
     # Create file record
     file_id = uuid.uuid4()
     storage_path = _file_storage_path(tenant_id, file_id)
 
-    # Save file via storage backend
+    # Save file via storage backend (true streaming, no RAM accumulation)
     storage = get_storage_backend()
-    await storage.save(storage_path, b"".join(chunks))
-    del chunks  # Free memory
+    await storage.save_stream(storage_path, chunk_stream())
+
+    content_hash = sha256.hexdigest()
 
     mime_type = file.content_type or "application/octet-stream"
 

app/plugins/builtins/kommunikation/routes.py

@@ -338,7 +338,7 @@ async def delete_msg(
 
 # ─── Attachments ───
 
-@router.post("/messages/{message_id}/attachments", dependencies=[Depends(require_permission("comm:write"))])
+@router.post("/messages/{message_id}/attachments", response_model=None, dependencies=[Depends(require_permission("comm:write"))])
 async def upload_attachment(
     message_id: str,
     file: UploadFile = File(...),

app/plugins/builtins/mail/routes.py

@@ -722,7 +722,7 @@ async def sync_folder(
 # ─── Attachment Upload (F-MAIL-04) ───
 
 
-@router.post("/upload-attachment")
+@router.post("/upload-attachment", response_model=None)
 async def upload_attachment(
     file: UploadFile = File(...),
     db: AsyncSession = Depends(get_db),

app/plugins/builtins/test_sample/__init__.py

@@ -0,0 +1,49 @@
+"""Test sample plugin for LeoCRM plugin system testing."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from app.plugins.base import BasePlugin
+from app.plugins.manifest import PluginManifest
+
+
+class TestSamplePlugin(BasePlugin):
+    """A sample plugin for testing the plugin lifecycle."""
+
+    manifest = PluginManifest(
+        name="test_sample",
+        version="1.0.0",
+        display_name="Test Sample Plugin",
+        description="A sample plugin for testing install/activate/deactivate/uninstall lifecycle.",
+        dependencies=[],
+        routes=[],
+        events=["contact.created"],
+        migrations=["0001_test_plugin.sql"],
+        permissions=[],
+    )
+
+    def __init__(self) -> None:
+        super().__init__()
+        self.install_called = False
+        self.activate_called = False
+        self.deactivate_called = False
+        self.uninstall_called = False
+        self.event_log: list[dict[str, Any]] = []
+
+    async def on_install(self, db, service_container) -> None:
+        self.install_called = True
+
+    async def on_activate(self, db, service_container, event_bus) -> None:
+        self.activate_called = True
+        await super().on_activate(db, service_container, event_bus)
+
+    async def on_deactivate(self, db, service_container, event_bus) -> None:
+        self.deactivate_called = True
+        await super().on_deactivate(db, service_container, event_bus)
+
+    async def on_uninstall(self, db, service_container) -> None:
+        self.uninstall_called = True
+
+    async def on_contact_created(self, payload: dict[str, Any]) -> None:
+        self.event_log.append({"event": "contact.created", "payload": payload})

app/plugins/builtins/test_sample/migrations/0001_test_plugin.sql

@@ -0,0 +1,9 @@
+-- Test sample plugin migration: creates a test table with tenant_id
+CREATE TABLE IF NOT EXISTS test_sample_items (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    name VARCHAR(100) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS ix_test_sample_items_tenant ON test_sample_items(tenant_id);