Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/ai_assistant/participant_handler.py

@@ -14,7 +14,7 @@ from typing import Any
 import litellm
 
 from app.core.db import create_db_session
-from app.plugins.builtins.kommunikation.participant_registry import ParticipantHandler
+from app.plugins.builtins.kommunikation.contracts import ParticipantHandler
 
 logger = logging.getLogger(__name__)
 
@@ -169,7 +169,7 @@ class AIParticipantHandler(ParticipantHandler):
         current_message: dict[str, Any],
     ) -> list[dict[str, str]]:
         """Build a messages array from the conversation history for the LLM."""
-        from app.plugins.builtins.kommunikation.services import get_messages
+        from app.plugins.builtins.kommunikation.contracts import get_messages
 
         messages: list[dict[str, str]] = []
 
@@ -232,7 +232,7 @@ class AIParticipantHandler(ParticipantHandler):
 
         # Load conversation
         try:
-            from app.plugins.builtins.kommunikation.services import get_conversation
+            from app.plugins.builtins.kommunikation.contracts import get_conversation
 
             async with create_db_session(tenant_id) as db:
                 # We need a user_id to load the conversation — use the sender_id from payload
@@ -249,7 +249,7 @@ class AIParticipantHandler(ParticipantHandler):
                     return
 
                 # Parse mentions from message content
-                from app.plugins.builtins.kommunikation.services import parse_mentions
+                from app.plugins.builtins.kommunikation.contracts import parse_mentions
 
                 mentions = parse_mentions(message_content)
 
@@ -265,7 +265,7 @@ class AIParticipantHandler(ParticipantHandler):
 
                 # If we got a response, send it to the conversation
                 if response_messages:
-                    from app.plugins.builtins.kommunikation.services import send_message
+                    from app.plugins.builtins.kommunikation.contracts import send_message
 
                     for resp_msg in response_messages:
                         await send_message(