Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

.a0/current_status.md

@@ -1,17 +1,21 @@
 # LeoCRM — Current Status
-**Phase**: 6 (Deployment) — COMPLETE
-**Last commit**: 1d3fccc (pushed to Forgejo)
-**Date**: 2026-07-02
+**Phase**: Fix Branch — P1-4 Complete
+**Last update**: 2026-07-25 19:17
+**Branch**: main (leocrm-fix)
 
-## Deployment Results
-- URL: https://crm.media-on.de ✅
-- Status: running:healthy ✅
-- Health: 200 OK ✅
-- Swagger: 200 OK ✅
-- PostgreSQL 16: running ✅
-- Redis 7: running ✅
-- Traefik SSL: Let's Encrypt ✅
+## P1-4: Transactional Outbox — COMPLETE
+- Migration 0040_outbox.py created (down_revision=0039_contact_normalize)
+- event_outbox table: id, tenant_id, event_name, payload JSONB, status, attempts, max_attempts, next_retry_at, timestamps
+- app/core/outbox.py: enqueue_outbox_event() + process_outbox_batch() with FOR UPDATE SKIP LOCKED, exponential backoff retry
+- app/core/event_bus.py: added publish_with_results() for error-aware publishing; docstring note about outbox
+- app/core/worker.py: process_outbox_job cron (every 5s, Redis distributed lock)
+- app/services/contact_service.py: contact.created, lead.created, contact.updated → enqueue_outbox_event
+- app/models/outbox.py: SQLAlchemy ORM model for event_outbox
+- tests/test_outbox.py: 6 tests, all passing
+- py_compile: OK, alembic heads: single head 0040_outbox
+
+## Previous: P2-1: Unified Contact Model normalisieren — COMPLETE
+- Migration 0039_contact_normalize.py (down_revision=0038_dms_content_hash)
 
 ## Next Step
-- Phase 6 → Phase 7 transition (requires user approval)
-- Phase 7: Release (release_auditor) — final audit, handoff
+- Continue with next fix task from FIX-PLAN.md