fix(permissions): fix 10 high-priority permission system issues

P8: Invalidate all Redis sessions when is_system_admin changes
- Added is_system_admin to UserUpdate schema and UserResponse
- Added invalidate_all_user_sessions call in users.py route
- Added is_system_admin param to user_service.update_user

P9: Remove no-op permission resolution strategies
- Only highest_wins supported, others removed as no-ops
- Updated tenant.py CheckConstraint to only allow highest_wins
- Added KI-Kommentar in permissions.py

P10: Remove legacy check_permission from auth.py
- Removed duplicate check_permission and filter_fields_by_permission
- Fixed ai_copilot_service.py to use permissions.check_permission
- Updated ai_copilot route to pass resolved permissions dict

P11: Verified — no guest_users remnants found

P12: Migrate ContactFolderPermission to EntityPermission
- contact_folder_permission_service now delegates to entity_permission_service
- contact_folder_service uses EntityPermission queries
- Removed ContactFolderPermission from models/__init__.py
- Created migration 0114 to migrate data and drop table

P13: Added RLS migration history comment in alembic/env.py

P14: Verified — services already apply visibility_filter
- saved_filters/views filter by user_id (personal data)
- workspaces are UI context only
- notifications already filter by entity access

P15: Split entity_permission_service.py (932 lines) into 4 modules
- permission_resolver.py: get_effective_access, get_visible_ids, etc.
- permission_cache.py: Redis caching functions
- permission_audit.py: Audit logging helpers
- entity_permission_service.py: CRUD operations + re-exports

P16: Centralize PERM_RANK in permissions.py
- Single source: app.core.permissions.PERM_RANK
- Updated all services to import from permissions.py

P17: Fix MIGRATION_DATABASE_URL to use crm_migration
- docker-compose.yaml defaults changed from crm_user to crm_migration
- .env.docker.example updated
- prestart.sh comment updated

app/routes/users.py

@@ -10,7 +10,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
 
 from app.core.audit import log_audit
-from app.core.auth import get_redis
+from app.core.auth import get_redis, invalidate_all_user_sessions
 from app.core.db import get_db
 from app.core.notifications import create_notification
 from app.core.permissions import invalidate_permission_cache
@@ -205,6 +205,13 @@ async def update_user(
             detail={"detail": "Only system admin can assign admin role", "code": "role_escalation_forbidden"},
         )
 
+    # Only system admin can change is_system_admin flag
+    if body.is_system_admin is not None and not current_user.get("is_system_admin"):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail={"detail": "Only system admin can change system admin flag", "code": "admin_flag_forbidden"},
+        )
+
     # Determine if role_id was explicitly sent (Pydantic v2)
     role_id_sent = "role_id" in body.model_fields_set
 
@@ -217,6 +224,8 @@ async def update_user(
         changes["role_id"] = body.role_id
     if body.is_active is not None:
         changes["is_active"] = body.is_active
+    if body.is_system_admin is not None:
+        changes["is_system_admin"] = body.is_system_admin
 
     # Pass _UNSET sentinel when role_id was not in the request body
     # so the service leaves the existing value untouched.
@@ -253,6 +262,7 @@ async def update_user(
             body.email,
             body.current_password,
             body.new_password,
+            body.is_system_admin,
         )
     except ValueError as exc:
         raise HTTPException(400, detail={"detail": str(exc), "code": "invalid_password"}) from None
@@ -276,6 +286,14 @@ async def update_user(
     redis = get_redis()
     await invalidate_permission_cache(redis, uid, tenant_id)
 
+    # If is_system_admin was changed, invalidate ALL sessions for this user
+    # so the stale admin flag doesn't persist in Redis until TTL (8h)
+    if body.is_system_admin is not None:
+        try:
+            await invalidate_all_user_sessions(redis, uid)
+        except Exception:
+            pass  # Best-effort — don't fail the update if Redis is down
+
     return {
         "id": str(user.id),
         "email": user.email,