Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/commands/__init__.py

@@ -0,0 +1,51 @@
+"""Command pattern package for LeoCRM.
+
+Commands encapsulate business operations with:
+- Authorization (permission check)
+- Execution (delegates to services)
+- Audit logging
+- Outbox event enqueuing
+- State machine validation
+
+Commands do NOT commit or rollback — the calling layer (FastAPI dependency
+``get_db``) manages the transaction boundary.
+"""
+
+from app.commands.base import BaseCommand, CommandResult
+from app.commands.contact_commands import (
+    CreateContactCommand,
+    UpdateContactCommand,
+    DeleteContactCommand,
+    MergeContactsCommand,
+)
+from app.commands.dms_commands import (
+    UploadFileCommand,
+    DeleteFileCommand,
+)
+from app.commands.mail_commands import (
+    SendMailCommand,
+    MarkMailReadCommand,
+    DeleteMailCommand,
+)
+from app.commands.calendar_commands import (
+    CreateCalendarEntryCommand,
+    UpdateCalendarEntryCommand,
+    DeleteCalendarEntryCommand,
+)
+
+__all__ = [
+    "BaseCommand",
+    "CommandResult",
+    "CreateContactCommand",
+    "UpdateContactCommand",
+    "DeleteContactCommand",
+    "MergeContactsCommand",
+    "UploadFileCommand",
+    "DeleteFileCommand",
+    "SendMailCommand",
+    "MarkMailReadCommand",
+    "DeleteMailCommand",
+    "CreateCalendarEntryCommand",
+    "UpdateCalendarEntryCommand",
+    "DeleteCalendarEntryCommand",
+]