fix: close remaining security gaps, test fixes, frontend integration, event bus

- RCE: move _check_dangerous_imports() BEFORE exec_module() in plugins.py
- verify_ws_origin: reject empty Origin header when CORS configured
- Test: ai_app fixture with permission_registry init for ai_assistant
- Test: login_client sets CSRF token + Origin as client default headers
- Test: SESSION_COOKIE_SECURE=false override + get_settings.cache_clear()
- Test: asyncio_default_test_loop_scope=session fixes event loop closed
- Test: fix 15 assertions (paths, variables, auth expectations)
- Frontend: integrate SavedFilterBar in ContactsList, Mail, Calendar
- Frontend: integrate TagSelector in ContactsList, Mail, Calendar
- Event Bus: add 4 subscribers in system_notif (conversation/participant/reaction)
- Docs: update all analysis reports and FIX-PLAN-V2 to current state

frontend/src/pages/Calendar.tsx

@@ -28,6 +28,9 @@ import { useCalendarStore, type CalendarViewMode } from '@/store/calendarStore';
 import { usePluginToolbarStore } from '@/store/pluginToolbarStore';
 import { ChevronLeft, ChevronRight, ExternalLink, Info, Plus } from 'lucide-react';
 import { PrintButton } from '@/components/common/PrintButton';
+import { SavedFilterBar } from '@/components/common/SavedFilterBar';
+import { TagSelector } from '@/components/tags/TagSelector';
+import type { Tag } from '@/api/tags';
 import {
   fetchCalendars,
   createCalendar,
@@ -80,6 +83,7 @@ export function CalendarPage() {
   const [showIcs, setShowIcs] = useState(false);
   const [deleteTarget, setDeleteTarget] = useState<CalendarEntry | null>(null);
   const [showDetails, setShowDetails] = useState(true);
+  const [selectedTags, setSelectedTags] = useState<Tag[]>([]);
 
   // Mobile view state
   const [activeView, setActiveView] = useState<'tree' | 'calendar' | 'details'>('tree');
@@ -597,6 +601,25 @@ export function CalendarPage() {
           data-testid="calendar-view-pane"
         >
           <div className="flex flex-col h-full">
+            {/* Saved filter bar + tag selector */}
+            <div className="flex items-center gap-2 px-3 py-2 border-b border-secondary-200 bg-secondary-50 flex-wrap" data-testid="calendar-filter-bar">
+              <SavedFilterBar
+                entityType="calendar"
+                currentFilters={{ viewMode, visibleMonth: visibleMonth.toISOString(), sortBy: viewMode }}
+                onApplyFilter={(criteria) => {
+                  if (criteria.viewMode) setViewMode(criteria.viewMode as CalendarViewMode);
+                }}
+              />
+              <div className="flex-1 min-w-[180px]" data-testid="calendar-tag-selector">
+                <TagSelector
+                  entityType="calendar_entry"
+                  entityId={selectedEntry?.id ?? ''}
+                  selectedTags={selectedTags}
+                  onChange={setSelectedTags}
+                  placeholder={t('tags.selectPlaceholder', 'Tags filtern...')}
+                />
+              </div>
+            </div>
             <div className="flex items-center justify-end px-3 py-1.5 border-b border-secondary-200" data-no-print>
               <PrintButton targetId="calendar-view" />
             </div>