fix(permissions): fix 10 high-priority permission system issues

P8: Invalidate all Redis sessions when is_system_admin changes
- Added is_system_admin to UserUpdate schema and UserResponse
- Added invalidate_all_user_sessions call in users.py route
- Added is_system_admin param to user_service.update_user

P9: Remove no-op permission resolution strategies
- Only highest_wins supported, others removed as no-ops
- Updated tenant.py CheckConstraint to only allow highest_wins
- Added KI-Kommentar in permissions.py

P10: Remove legacy check_permission from auth.py
- Removed duplicate check_permission and filter_fields_by_permission
- Fixed ai_copilot_service.py to use permissions.check_permission
- Updated ai_copilot route to pass resolved permissions dict

P11: Verified — no guest_users remnants found

P12: Migrate ContactFolderPermission to EntityPermission
- contact_folder_permission_service now delegates to entity_permission_service
- contact_folder_service uses EntityPermission queries
- Removed ContactFolderPermission from models/__init__.py
- Created migration 0114 to migrate data and drop table

P13: Added RLS migration history comment in alembic/env.py

P14: Verified — services already apply visibility_filter
- saved_filters/views filter by user_id (personal data)
- workspaces are UI context only
- notifications already filter by entity access

P15: Split entity_permission_service.py (932 lines) into 4 modules
- permission_resolver.py: get_effective_access, get_visible_ids, etc.
- permission_cache.py: Redis caching functions
- permission_audit.py: Audit logging helpers
- entity_permission_service.py: CRUD operations + re-exports

P16: Centralize PERM_RANK in permissions.py
- Single source: app.core.permissions.PERM_RANK
- Updated all services to import from permissions.py

P17: Fix MIGRATION_DATABASE_URL to use crm_migration
- docker-compose.yaml defaults changed from crm_user to crm_migration
- .env.docker.example updated
- prestart.sh comment updated

alembic/env.py

@@ -20,6 +20,9 @@ if config.config_file_name is not None:
 
 target_metadata = Base.metadata
 settings = get_settings()
+# ⚠️ RLS Migration History: 21 Migrationen mit 8 Disable-Zyklen. Dies ist historisch bedingt
+# und zeigt trial-and-error. Aktuelle RLS-Konfiguration ist stabil (113 Tabellen).
+# Bei neuen RLS-Änderungen nur noch Migration-Runner nutzen.
 # Use migration_database_url (crm_migration role, table owner) for Alembic
 config.set_main_option("sqlalchemy.url", settings.migration_database_url or settings.database_url)
 

alembic/versions/0114_migrate_contact_folder_permissions_to_entity_permissions.py

@@ -0,0 +1,122 @@
+"""Migrate contact_folder_permissions to entity_permissions.
+
+This migration moves all ACL entries from the dedicated
+``contact_folder_permissions`` table into the universal
+``entity_permissions`` table with ``entity_type='contact_folder'``.
+
+Mapping:
+- folder_id          → entity_id (entity_type='contact_folder')
+- user_id            → principal_type='user',  principal_id=user_id
+- group_id           → principal_type='group', principal_id=group_id
+- permission_level   → permission_level (unchanged)
+- inherit_to_subfolders is dropped (always treated as True after migration)
+
+After data migration the ``contact_folder_permissions`` table is dropped.
+
+Revision ID: 0114
+Revises: 0113
+"""
+
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0114"
+down_revision = "0113"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # 1. Migrate user-based permissions
+    op.execute("""
+        INSERT INTO entity_permissions (
+            id, tenant_id, entity_type, entity_id,
+            principal_type, principal_id,
+            permission_level, created_at, updated_at
+        )
+        SELECT
+            cfp.id,
+            cfp.tenant_id,
+            'contact_folder',
+            cfp.folder_id,
+            'user',
+            cfp.user_id,
+            cfp.permission_level,
+            cfp.created_at,
+            cfp.updated_at
+        FROM contact_folder_permissions cfp
+        WHERE cfp.user_id IS NOT NULL
+        ON CONFLICT DO NOTHING
+    """)
+
+    # 2. Migrate group-based permissions
+    op.execute("""
+        INSERT INTO entity_permissions (
+            id, tenant_id, entity_type, entity_id,
+            principal_type, principal_id,
+            permission_level, created_at, updated_at
+        )
+        SELECT
+            cfp.id,
+            cfp.tenant_id,
+            'contact_folder',
+            cfp.folder_id,
+            'group',
+            cfp.group_id,
+            cfp.permission_level,
+            cfp.created_at,
+            cfp.updated_at
+        FROM contact_folder_permissions cfp
+        WHERE cfp.group_id IS NOT NULL
+        ON CONFLICT DO NOTHING
+    """)
+
+    # 3. Drop the old table
+    op.execute("DROP TABLE IF EXISTS contact_folder_permissions CASCADE")
+
+
+def downgrade() -> None:
+    # Recreate the old table (data is lost — this is a one-way migration)
+    op.execute("""
+        CREATE TABLE IF NOT EXISTS contact_folder_permissions (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            tenant_id UUID NOT NULL,
+            folder_id UUID NOT NULL REFERENCES contact_folders(id) ON DELETE CASCADE,
+            user_id UUID REFERENCES users(id) ON DELETE CASCADE,
+            group_id UUID REFERENCES groups(id) ON DELETE CASCADE,
+            permission_level VARCHAR(20) NOT NULL DEFAULT 'read',
+            inherit_to_subfolders BOOLEAN NOT NULL DEFAULT TRUE,
+            created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+            updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+        )
+    """)
+
+    # Restore user permissions
+    op.execute("""
+        INSERT INTO contact_folder_permissions (
+            id, tenant_id, folder_id, user_id, group_id,
+            permission_level, inherit_to_subfolders, created_at, updated_at
+        )
+        SELECT
+            ep.id,
+            ep.tenant_id,
+            ep.entity_id,
+            CASE WHEN ep.principal_type = 'user' THEN ep.principal_id ELSE NULL END,
+            CASE WHEN ep.principal_type = 'group' THEN ep.principal_id ELSE NULL END,
+            ep.permission_level,
+            TRUE,
+            ep.created_at,
+            ep.updated_at
+        FROM entity_permissions ep
+        WHERE ep.entity_type = 'contact_folder'
+          AND ep.principal_type IN ('user', 'group')
+        ON CONFLICT DO NOTHING
+    """)
+
+    # Remove migrated entries from entity_permissions
+    op.execute("""
+        DELETE FROM entity_permissions
+        WHERE entity_type = 'contact_folder'
+          AND principal_type IN ('user', 'group')
+    """)