Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/ai_proactive/participant_handler.py

@@ -11,7 +11,7 @@ import uuid
 from typing import Any
 
 from app.core.db import create_db_session
-from app.plugins.builtins.kommunikation.participant_registry import ParticipantHandler
+from app.plugins.builtins.kommunikation.contracts import ParticipantHandler
 
 logger = logging.getLogger(__name__)
 
@@ -173,7 +173,7 @@ class AIProactiveParticipantHandler(ParticipantHandler):
 
         # Load conversation
         try:
-            from app.plugins.builtins.kommunikation.services import get_conversation
+            from app.plugins.builtins.kommunikation.contracts import get_conversation
 
             async with create_db_session(tenant_id) as db:
                 if not sender_id_str:
@@ -188,7 +188,7 @@ class AIProactiveParticipantHandler(ParticipantHandler):
                     return
 
                 # Parse mentions from message content
-                from app.plugins.builtins.kommunikation.services import parse_mentions
+                from app.plugins.builtins.kommunikation.contracts import parse_mentions
 
                 mentions = parse_mentions(message_content)
 
@@ -204,7 +204,7 @@ class AIProactiveParticipantHandler(ParticipantHandler):
 
                 # If we got a response, send it to the conversation
                 if response_messages:
-                    from app.plugins.builtins.kommunikation.services import send_message
+                    from app.plugins.builtins.kommunikation.contracts import send_message
 
                     for resp_msg in response_messages:
                         await send_message(