Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/automation/agent_comm.py

@@ -55,8 +55,8 @@ async def send_agent_message(
 
     # 2. Create a kommunikation message in a dedicated agent room
     try:
-        from app.plugins.builtins.kommunikation.models import Message, Room
-        from app.plugins.builtins.kommunikation.services import RoomService
+        from app.plugins.builtins.kommunikation.contracts import Message, Room
+        from app.plugins.builtins.kommunikation.contracts import RoomService
 
         # Find or create the agent-to-agent room
         room_name = f"agent:{from_agent_id}:{target_agent.id}"
@@ -129,7 +129,7 @@ async def send_agent_message(
 
 def register_agent_comm_tool():
     """Register the send_agent_message tool in the global tool registry."""
-    from app.plugins.builtins.ai_assistant.tool_registry import get_tool_registry
+    from app.plugins.builtins.ai_assistant.contracts import get_tool_registry
 
     registry = get_tool_registry()
 
@@ -188,7 +188,7 @@ def register_agent_comm_tool():
 
 def unregister_agent_comm_tool():
     """Unregister the send_agent_message tool."""
-    from app.plugins.builtins.ai_assistant.tool_registry import get_tool_registry
+    from app.plugins.builtins.ai_assistant.contracts import get_tool_registry
 
     registry = get_tool_registry()
     registry.unregister("send_agent_message")

app/plugins/builtins/automation/agent_routes.py

@@ -149,7 +149,7 @@ async def list_tools(
 ):
     """List available tools from the tool registry."""
     try:
-        from app.plugins.builtins.ai_assistant.tool_registry import (
+        from app.plugins.builtins.ai_assistant.contracts import (
             get_tool_registry,
         )
 

app/plugins/builtins/automation/agent_runner.py

@@ -191,7 +191,7 @@ async def run_agent(
 
             # Execute tool calls if LLM returned function calls
             if hasattr(response.choices[0].message, "tool_calls") and response.choices[0].message.tool_calls:
-                from app.plugins.builtins.ai_assistant.tool_registry import get_tool_registry
+                from app.plugins.builtins.ai_assistant.contracts import get_tool_registry
 
                 registry = get_tool_registry()
                 tool_call_count: dict[str, int] = {}

app/plugins/builtins/automation/plugin.py

@@ -137,7 +137,7 @@ class AutomationPlugin(BasePlugin):
             logger.exception("Failed to register agent communication tool")
         # Register MiniApps from manifest
         try:
-            from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+            from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
             registry = MiniAppRegistry()
             for miniapp in self.manifest.miniapps:
                 registry.register(
@@ -170,7 +170,7 @@ class AutomationPlugin(BasePlugin):
             logger.exception("Failed to unregister agent communication tool")
         # Unregister MiniApps
         try:
-            from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+            from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
             registry = MiniAppRegistry()
             registry.unregister_plugin(self.manifest.name)
             logger.info("Unregistered MiniApps for plugin '%s'", self.manifest.name)

app/plugins/builtins/automation/routes.py

@@ -179,7 +179,7 @@ async def list_miniapps(
     current_user: dict[str, Any] = Depends(get_current_user),
 ):
     """List custom MiniApps from plugin config."""
-    from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+    from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
     registry = MiniAppRegistry()
     items = registry.list_apps()
     return {"items": items, "total": len(items)}
@@ -196,7 +196,7 @@ async def create_miniapp(
     current_user: dict[str, Any] = Depends(get_current_user),
 ):
     """Create a custom MiniApp definition."""
-    from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+    from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
     registry = MiniAppRegistry()
     registry.register(
         app_id=data.app_id,
@@ -225,7 +225,7 @@ async def delete_miniapp(
     current_user: dict[str, Any] = Depends(get_current_user),
 ):
     """Delete a custom MiniApp definition."""
-    from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+    from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
     registry = MiniAppRegistry()
     registry.unregister(app_id)
     return {"status": "ok"}