fix: close remaining security gaps, test fixes, frontend integration, event bus

- RCE: move _check_dangerous_imports() BEFORE exec_module() in plugins.py
- verify_ws_origin: reject empty Origin header when CORS configured
- Test: ai_app fixture with permission_registry init for ai_assistant
- Test: login_client sets CSRF token + Origin as client default headers
- Test: SESSION_COOKIE_SECURE=false override + get_settings.cache_clear()
- Test: asyncio_default_test_loop_scope=session fixes event loop closed
- Test: fix 15 assertions (paths, variables, auth expectations)
- Frontend: integrate SavedFilterBar in ContactsList, Mail, Calendar
- Frontend: integrate TagSelector in ContactsList, Mail, Calendar
- Event Bus: add 4 subscribers in system_notif (conversation/participant/reaction)
- Docs: update all analysis reports and FIX-PLAN-V2 to current state

app/routes/plugins.py

@@ -383,7 +383,15 @@ def _extract_plugin_from_zip(zip_path: str) -> tuple[Path, str, type[BasePlugin]
         if plugin_py_path is None:
             raise ValueError("ZIP does not contain a plugin.py file")
 
-        # Import the module dynamically
+        # Security: check source code BEFORE executing it
+        source_code = plugin_py_path.read_text(encoding="utf-8")
+        dangerous = _check_dangerous_imports(source_code)
+        if dangerous:
+            raise ValueError(
+                f"Plugin contains dangerous patterns: {', '.join(dangerous)}"
+            )
+
+        # Import the module dynamically (safe — source validated above)
         spec = importlib.util.spec_from_file_location(
             "uploaded_plugin", plugin_py_path
         )
@@ -412,14 +420,6 @@ def _extract_plugin_from_zip(zip_path: str) -> tuple[Path, str, type[BasePlugin]
         # Validate plugin name
         _validate_manifest_name(manifest.name)
 
-        # Check for dangerous imports in plugin.py
-        source_code = plugin_py_path.read_text(encoding="utf-8")
-        dangerous = _check_dangerous_imports(source_code)
-        if dangerous:
-            raise ValueError(
-                f"Plugin contains dangerous patterns: {', '.join(dangerous)}"
-            )
-
         # Check migration SQL files
         migrations_dir = plugin_py_path.parent / "migrations"
         if migrations_dir.exists():