Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/mail/routes.py

@@ -1477,7 +1477,10 @@ async def create_event_from_mail(
     account = await _get_account(db, mail.account_id, tenant_id, user_id)
     await _check_delegate_access(db, account, user_id, "write")
     try:
-        from app.plugins.builtins.calendar.models import Calendar, CalendarEntry
+        from app.plugins.builtins.calendar.contracts import get_contract as get_calendar_contract
+        _cal = get_calendar_contract()
+        Calendar = _cal.Calendar
+        CalendarEntry = _cal.CalendarEntry
     except ImportError:
         return {"created": False, "error": "Calendar plugin not available"}
     cal_id = _parse_uuid(data.calendar_id, "calendar_id")