Phase 1: Fix all critical release blockers (B1-B10)

B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports

Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.

app/plugins/builtins/dms/routes.py

@@ -417,7 +417,7 @@ async def delete_folder(
 # ─── Files ───
 
 
-@router.post("/files/upload", status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_permission("dms:write"))])
+@router.post("/files/upload", status_code=status.HTTP_201_CREATED, response_model=None, dependencies=[Depends(require_permission("dms:write"))])
 async def upload_file(
     file: UploadFile = File(...),
     folder_id: str | None = Form(None),
@@ -441,35 +441,35 @@ async def upload_file(
         if folder_result.scalar_one_or_none() is None:
             raise HTTPException(404, detail={"detail": "Folder not found", "code": "not_found"})
 
-    # Stream file in chunks — avoid loading entire file into RAM
+    # Stream file to storage — avoid loading entire file into RAM
     import hashlib
     CHUNK_SIZE = 1024 * 1024  # 1MB chunks
     sha256 = hashlib.sha256()
     file_size = 0
-    chunks: list[bytes] = []
 
-    while True:
-        chunk = await file.read(CHUNK_SIZE)
-        if not chunk:
-            break
-        file_size += len(chunk)
-        if file_size > MAX_FILE_SIZE:
-            raise HTTPException(
-                413, detail={"detail": "File too large (max 100MB)", "code": "file_too_large"}
-            )
-        sha256.update(chunk)
-        chunks.append(chunk)
-
-    content_hash = sha256.hexdigest()
+    async def chunk_stream():
+        nonlocal file_size
+        while True:
+            chunk = await file.read(CHUNK_SIZE)
+            if not chunk:
+                break
+            file_size += len(chunk)
+            if file_size > MAX_FILE_SIZE:
+                raise HTTPException(
+                    413, detail={"detail": "File too large (max 100MB)", "code": "file_too_large"}
+                )
+            sha256.update(chunk)
+            yield chunk
 
     # Create file record
     file_id = uuid.uuid4()
     storage_path = _file_storage_path(tenant_id, file_id)
 
-    # Save file via storage backend
+    # Save file via storage backend (true streaming, no RAM accumulation)
     storage = get_storage_backend()
-    await storage.save(storage_path, b"".join(chunks))
-    del chunks  # Free memory
+    await storage.save_stream(storage_path, chunk_stream())
+
+    content_hash = sha256.hexdigest()
 
     mime_type = file.content_type or "application/octet-stream"