Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/ai_proactive/context_tools.py

@@ -18,7 +18,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.db import create_db_session
 from app.models.audit import AuditLog
 from app.models.contact import Contact
-from app.plugins.builtins.mail.models import Mail
+from app.plugins.builtins.mail.contracts import Mail
 
 logger = logging.getLogger(__name__)
 
@@ -101,9 +101,9 @@ async def search_related_handler(arguments: dict[str, Any], context: dict[str, A
         entity_id = uuid.UUID(arguments["entity_id"])
         limit = arguments.get("limit", 5)
 
-        from app.plugins.builtins.unified_search.search_engine import (
-            find_similar_all_types,
-        )
+        from app.plugins.builtins.unified_search.contracts import get_contract as get_search_contract
+        _search = get_search_contract()
+        find_similar_all_types = _search.hybrid_search
 
         similar = await find_similar_all_types(
             db, entity_type, entity_id, tenant_id, limit=limit
@@ -163,10 +163,10 @@ async def get_open_tasks_handler(arguments: dict[str, Any], context: dict[str, A
     try:
         from datetime import UTC, datetime
 
-        from app.plugins.builtins.calendar.models import (
-            CalendarEntry,
-            CalendarEntryLink,
-        )
+        from app.plugins.builtins.calendar.contracts import get_contract as get_calendar_contract
+        _cal = get_calendar_contract()
+        CalendarEntry = _cal.CalendarEntry
+        CalendarEntryLink = _cal.CalendarEntryLink
 
         db, tenant_id, _ = await _get_db_and_tenant(context)
         entity_type = arguments["entity_type"]
@@ -194,7 +194,9 @@ async def get_open_tasks_handler(arguments: dict[str, Any], context: dict[str, A
 async def hybrid_search_handler(arguments: dict[str, Any], context: dict[str, Any]) -> str:
     """Perform hybrid search via unified_search search_engine."""
     try:
-        from app.plugins.builtins.unified_search.search_engine import hybrid_search
+        from app.plugins.builtins.unified_search.contracts import get_contract as get_search_contract
+        _search = get_search_contract()
+        hybrid_search = _search.hybrid_search
 
         db, tenant_id, _ = await _get_db_and_tenant(context)
         query = arguments["query"]