Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/mail/contracts.py

@@ -0,0 +1,45 @@
+"""Public contract for the mail plugin.
+
+Exposes only the symbols that other builtins plugins need.
+Currently the only cross-plugin consumer is ai_proactive, which imports
+the ``Mail`` model for querying recent emails by contact.
+
+Importers should use::
+
+    from app.plugins.builtins.contracts import get_contract
+    mail = get_contract("mail")
+    if mail:
+        result = await db.execute(select(mail.Mail).where(...))
+
+instead of importing from internal modules directly.
+"""
+
+from __future__ import annotations
+
+from app.plugins.builtins.contracts import get_contract_registry
+from app.plugins.builtins.mail.models import Mail
+
+
+class MailContract:
+    """Public API surface for the mail plugin.
+
+    Exposes the ``Mail`` ORM model so that other plugins can query the
+    mails table without importing from ``mail.models`` directly.
+    """
+
+    contract_name = "mail"
+
+    # ─── models ───
+    Mail = Mail
+
+
+# ─── self-registration ───
+
+_contract = MailContract()
+get_contract_registry().register("mail", _contract)
+
+
+__all__ = [
+    "MailContract",
+    "Mail",
+]