Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/models/contact.py

@@ -8,17 +8,20 @@ ansprechpartner (company employees / contact persons).
 from __future__ import annotations
 
 import uuid
+from decimal import Decimal
 from typing import Any
 
 from sqlalchemy import (
     Computed,
- ForeignKey,
+    ForeignKey,
     Index,
+    Numeric,
     String,
     Text,
     Float,
-    JSON,
+    UniqueConstraint,
 )
+from sqlalchemy.dialects.postgresql import JSONB
 from sqlalchemy.dialects.postgresql import TSVECTOR
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
@@ -37,6 +40,8 @@ class Contact(Base, TenantMixin):
 
     __tablename__ = "contacts"
     __table_args__ = (
+        UniqueConstraint("tenant_id", "code", name="uq_contacts_tenant_code"),
+        UniqueConstraint("tenant_id", "accounting_code", name="uq_contacts_tenant_accounting_code"),
         Index("ix_contacts_tenant_deleted", "tenant_id", "deleted_at"),
         Index("ix_contacts_tenant_type", "tenant_id", "type"),
         Index("ix_contacts_tenant_name", "tenant_id", "name"),
@@ -53,10 +58,13 @@ class Contact(Base, TenantMixin):
     # ── Identity & Type ──
     type: Mapped[str] = mapped_column(String(20), nullable=False, default="company")  # 'company' or 'person'
     displayname: Mapped[str] = mapped_column(String(255), nullable=False, default="")
+
+    # ── Lifecycle Status (state machine: lead → qualified → customer → inactive) ──
+    status: Mapped[str] = mapped_column(String(30), nullable=False, default="lead", index=True)
     name: Mapped[str | None] = mapped_column(String(255), nullable=True)  # company name
     firstname: Mapped[str | None] = mapped_column(String(100), nullable=True)
     surname: Mapped[str | None] = mapped_column(String(100), nullable=True)
-    surfix: Mapped[str | None] = mapped_column(String(50), nullable=True)  # name prefix (Dr., Prof.)
+    suffix: Mapped[str | None] = mapped_column(String(50), nullable=True)  # name prefix (Dr., Prof.)
     ext_name_line: Mapped[str | None] = mapped_column(String(255), nullable=True)  # additional name line / subtitle
     gender: Mapped[str | None] = mapped_column(String(20), nullable=True)
 
@@ -116,12 +124,12 @@ class Contact(Base, TenantMixin):
     bank_account: Mapped[str | None] = mapped_column(String(50), nullable=True)  # IBAN
 
     # ── Discounts ──
-    discount_crew: Mapped[float] = mapped_column(Float, nullable=False, default=0)
-    discount_transport: Mapped[float] = mapped_column(Float, nullable=False, default=0)
-    discount_rental: Mapped[float] = mapped_column(Float, nullable=False, default=0)
-    discount_sale: Mapped[float] = mapped_column(Float, nullable=False, default=0)
-    discount_subrent: Mapped[float] = mapped_column(Float, nullable=False, default=0)
-    discount_total: Mapped[float] = mapped_column(Float, nullable=False, default=0)
+    discount_crew: Mapped[Decimal] = mapped_column(Numeric(5, 2), nullable=False, default=0)
+    discount_transport: Mapped[Decimal] = mapped_column(Numeric(5, 2), nullable=False, default=0)
+    discount_rental: Mapped[Decimal] = mapped_column(Numeric(5, 2), nullable=False, default=0)
+    discount_sale: Mapped[Decimal] = mapped_column(Numeric(5, 2), nullable=False, default=0)
+    discount_subrent: Mapped[Decimal] = mapped_column(Numeric(5, 2), nullable=False, default=0)
+    discount_total: Mapped[Decimal] = mapped_column(Numeric(5, 2), nullable=False, default=0)
 
     # ── Geo ──
     latitude: Mapped[float | None] = mapped_column(Float, nullable=True)
@@ -151,7 +159,7 @@ class Contact(Base, TenantMixin):
     )
 
     # ── Custom fields ──
-    custom: Mapped[dict | None] = mapped_column(JSON, nullable=True, default=dict)
+    custom: Mapped[dict | None] = mapped_column(JSONB, nullable=True, default=dict)
 
     # ── FTS ──
     search_tsv: Mapped[Any] = mapped_column(
@@ -222,7 +230,7 @@ class ContactPerson(Base, TenantMixin):
 
     # ── Other ──
     tags: Mapped[str | None] = mapped_column(String(500), nullable=True)
-    custom: Mapped[dict | None] = mapped_column(JSON, nullable=True, default=dict)
+    custom: Mapped[dict | None] = mapped_column(JSONB, nullable=True, default=dict)
 
     # ── Audit ──
     created_by: Mapped[uuid.UUID | None] = mapped_column(