fix: close remaining security gaps, test fixes, frontend integration, event bus

- RCE: move _check_dangerous_imports() BEFORE exec_module() in plugins.py
- verify_ws_origin: reject empty Origin header when CORS configured
- Test: ai_app fixture with permission_registry init for ai_assistant
- Test: login_client sets CSRF token + Origin as client default headers
- Test: SESSION_COOKIE_SECURE=false override + get_settings.cache_clear()
- Test: asyncio_default_test_loop_scope=session fixes event loop closed
- Test: fix 15 assertions (paths, variables, auth expectations)
- Frontend: integrate SavedFilterBar in ContactsList, Mail, Calendar
- Frontend: integrate TagSelector in ContactsList, Mail, Calendar
- Event Bus: add 4 subscribers in system_notif (conversation/participant/reaction)
- Docs: update all analysis reports and FIX-PLAN-V2 to current state

pyproject.toml

@@ -10,6 +10,8 @@ requires-python = ">=3.11"
 
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "session"
+asyncio_default_test_loop_scope = "session"
 testpaths = ["tests"]
 python_files = ["test_*.py"]
 python_classes = ["Test*"]