Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/automation/plugin.py

@@ -137,7 +137,7 @@ class AutomationPlugin(BasePlugin):
             logger.exception("Failed to register agent communication tool")
         # Register MiniApps from manifest
         try:
-            from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+            from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
             registry = MiniAppRegistry()
             for miniapp in self.manifest.miniapps:
                 registry.register(
@@ -170,7 +170,7 @@ class AutomationPlugin(BasePlugin):
             logger.exception("Failed to unregister agent communication tool")
         # Unregister MiniApps
         try:
-            from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+            from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
             registry = MiniAppRegistry()
             registry.unregister_plugin(self.manifest.name)
             logger.info("Unregistered MiniApps for plugin '%s'", self.manifest.name)