Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/automation/routes.py

@@ -179,7 +179,7 @@ async def list_miniapps(
     current_user: dict[str, Any] = Depends(get_current_user),
 ):
     """List custom MiniApps from plugin config."""
-    from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+    from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
     registry = MiniAppRegistry()
     items = registry.list_apps()
     return {"items": items, "total": len(items)}
@@ -196,7 +196,7 @@ async def create_miniapp(
     current_user: dict[str, Any] = Depends(get_current_user),
 ):
     """Create a custom MiniApp definition."""
-    from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+    from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
     registry = MiniAppRegistry()
     registry.register(
         app_id=data.app_id,
@@ -225,7 +225,7 @@ async def delete_miniapp(
     current_user: dict[str, Any] = Depends(get_current_user),
 ):
     """Delete a custom MiniApp definition."""
-    from app.plugins.builtins.kommunikation.miniapp_registry import MiniAppRegistry
+    from app.plugins.builtins.kommunikation.contracts import MiniAppRegistry
     registry = MiniAppRegistry()
     registry.unregister(app_id)
     return {"status": "ok"}