Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/ai_proactive/jobs.py

@@ -30,7 +30,7 @@ from app.plugins.builtins.ai_proactive.services import (
     get_user_settings,
     push_suggestion,
 )
-from app.plugins.builtins.mail.models import Mail
+from app.plugins.builtins.mail.contracts import Mail
 
 logger = logging.getLogger(__name__)
 
@@ -175,9 +175,10 @@ async def deep_analysis(
 
         # Similar entities via unified_search
         try:
-            from app.plugins.builtins.unified_search.search_engine import (
-                find_similar_all_types,
-            )
+            from app.plugins.builtins.unified_search.contracts import get_contract as get_search_contract
+            _search = get_search_contract()
+            hybrid_search = _search.hybrid_search
+            find_similar_all_types = _search.hybrid_search  # alias
 
             extended_context["similar"] = await find_similar_all_types(
                 db, entity_type, eid, tid, limit=5
@@ -335,7 +336,7 @@ async def heartbeat(ctx: dict[str, Any], user_id: str, tenant_id: str) -> None:
 
     try:
         from app.core.db import create_db_session
-        from app.plugins.builtins.kommunikation.services import (
+        from app.plugins.builtins.kommunikation.contracts import (
             create_plugin_room,
             send_message,
         )