fix: Event-bus workflow trigger, RBAC on all routes, search provider, events, cron jobs

Critical fixes:
- Event Bus → Workflow auto-trigger: wildcard subscription starts workflows on matching events
- Kommunikation routes: require_permission on all 30+ endpoints (comm:read/write/delete/manage)
- Permissions routes: require_permission('permissions:admin') on all management endpoints
- CompanySearchProvider registered in auto_register_providers()

Medium fixes:
- system_notif events: 10 event_bus.publish() calls added (lead.created, contact.created/updated,
  task.created/overdue, mail.received, user.created, workflow.completed, notification.created, backup.*)
- Cron jobs: backup_check (daily), search_index_check (daily), workflow_timeout (5min) registered
- AI tool permission: call_crm_api now requires 'ai:write' permission
- New file: automation/jobs.py with backup_check and search_index_check functions

app/plugins/builtins/permissions/routes.py

@@ -12,7 +12,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.auth import hash_password, verify_password
 from app.core.db import get_db
-from app.deps import get_current_user
+from app.deps import get_current_user, require_permission
 from app.plugins.builtins.permissions.models import Permission, ShareLink
 from app.plugins.builtins.permissions.schemas import (
     PermissionGrantRequest,
@@ -20,7 +20,11 @@ from app.plugins.builtins.permissions.schemas import (
     ShareLinkVerifyRequest,
 )
 
-router = APIRouter(prefix="/api/v1/permissions", tags=["permissions"])
+router = APIRouter(
+    prefix="/api/v1/permissions",
+    tags=["permissions"],
+    dependencies=[Depends(require_permission("permissions:admin"))],
+)
 public_router = APIRouter(prefix="/api/public", tags=["public-share"])