fix: Event-bus workflow trigger, RBAC on all routes, search provider, events, cron jobs

Critical fixes:
- Event Bus → Workflow auto-trigger: wildcard subscription starts workflows on matching events
- Kommunikation routes: require_permission on all 30+ endpoints (comm:read/write/delete/manage)
- Permissions routes: require_permission('permissions:admin') on all management endpoints
- CompanySearchProvider registered in auto_register_providers()

Medium fixes:
- system_notif events: 10 event_bus.publish() calls added (lead.created, contact.created/updated,
  task.created/overdue, mail.received, user.created, workflow.completed, notification.created, backup.*)
- Cron jobs: backup_check (daily), search_index_check (daily), workflow_timeout (5min) registered
- AI tool permission: call_crm_api now requires 'ai:write' permission
- New file: automation/jobs.py with backup_check and search_index_check functions

app/services/contact_service.py

@@ -248,6 +248,22 @@ async def create_contact(
         action="create", snapshot_after=serialized,
     )
 
+    # Publish events
+    from app.core.event_bus import get_event_bus
+    event_bus = get_event_bus()
+    await event_bus.publish('contact.created', {
+        'contact_id': str(contact.id),
+        'tenant_id': str(tenant_id),
+        'user_id': str(user_id),
+        'type': data.get('type', 'person'),
+    })
+    if data.get('type') == 'company':
+        await event_bus.publish('lead.created', {
+            'contact_id': str(contact.id),
+            'tenant_id': str(tenant_id),
+            'user_id': str(user_id),
+        })
+
     return serialized
 
 
@@ -301,6 +317,16 @@ async def update_contact(
         changes=changes or None,
     )
 
+    # Publish contact.updated event
+    from app.core.event_bus import get_event_bus
+    event_bus = get_event_bus()
+    await event_bus.publish('contact.updated', {
+        'contact_id': str(contact.id),
+        'tenant_id': str(tenant_id),
+        'user_id': str(user_id),
+        'type': contact.type,
+    })
+
     return snapshot_after