fix: close remaining security gaps, test fixes, frontend integration, event bus

- RCE: move _check_dangerous_imports() BEFORE exec_module() in plugins.py
- verify_ws_origin: reject empty Origin header when CORS configured
- Test: ai_app fixture with permission_registry init for ai_assistant
- Test: login_client sets CSRF token + Origin as client default headers
- Test: SESSION_COOKIE_SECURE=false override + get_settings.cache_clear()
- Test: asyncio_default_test_loop_scope=session fixes event loop closed
- Test: fix 15 assertions (paths, variables, auth expectations)
- Frontend: integrate SavedFilterBar in ContactsList, Mail, Calendar
- Frontend: integrate TagSelector in ContactsList, Mail, Calendar
- Event Bus: add 4 subscribers in system_notif (conversation/participant/reaction)
- Docs: update all analysis reports and FIX-PLAN-V2 to current state

frontend/src/pages/ContactsList.tsx

@@ -16,6 +16,9 @@ import { ContactDetail } from '@/components/contacts/ContactDetail';
 import { ContactEditForm } from '@/components/contacts/ContactEditForm';
 import { useWindowStore } from '@/store/windowStore';
 import { SavedFilters } from '@/components/SavedFilters';
+import { SavedFilterBar } from '@/components/common/SavedFilterBar';
+import { TagSelector } from '@/components/tags/TagSelector';
+import type { Tag } from '@/api/tags';
 import { ArrowDownAZ, ArrowUpZA, Bookmark, ChevronLeft, ExternalLink, LayoutGrid, List, Plus, Printer } from 'lucide-react';
 import {
   useUnifiedContacts,
@@ -38,6 +41,7 @@ export function ContactsListPage() {
   const [selectedContactId, setSelectedContactId] = useState<string | null>(null);
   const [activeView, setActiveView] = useState<'folders' | 'list' | 'detail'>('folders');
   const [savedFiltersOpen, setSavedFiltersOpen] = useState(false);
+  const [selectedTags, setSelectedTags] = useState<Tag[]>([]);
   const openWindow = useWindowStore((s) => s.openWindow);
 
   // Debounce search
@@ -367,6 +371,29 @@ export function ContactsListPage() {
           className="border-r border-secondary-200 bg-white"
           data-testid="contact-list-pane"
         >
+          {/* Saved filter bar + tag selector */}
+          <div className="flex items-center gap-2 px-3 py-2 border-b border-secondary-200 bg-secondary-50 flex-wrap" data-testid="contacts-filter-bar">
+            <SavedFilterBar
+              entityType="contacts"
+              currentFilters={{ search: debouncedSearch, type: contactType, sortBy, sortOrder, folderId, tagFilter }}
+              onApplyFilter={(criteria) => {
+                if (criteria.search) setSearch(criteria.search); else setSearch('');
+                if (criteria.sortBy) setSortBy(criteria.sortBy);
+                if (criteria.sortOrder) setSortOrder(criteria.sortOrder);
+                if (criteria.type) setSelectedFilter(criteria.type as ContactFilter);
+                setPage(1);
+              }}
+            />
+            <div className="flex-1 min-w-[180px]" data-testid="contacts-tag-selector">
+              <TagSelector
+                entityType="contact"
+                entityId={selectedContactId ?? ''}
+                selectedTags={selectedTags}
+                onChange={setSelectedTags}
+                placeholder={t('tags.selectPlaceholder', 'Tags filtern...')}
+              />
+            </div>
+          </div>
           {/* List — no inline toolbar, all controls are in the plugin toolbar */}
           <div className="flex-1 min-h-0" id="contacts-table">
             <ContactList