Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/plugins/builtins/unified_search/contracts.py

@@ -0,0 +1,23 @@
+"""Unified Search plugin contract — public interface for cross-plugin access."""
+
+from __future__ import annotations
+
+from app.plugins.builtins.unified_search.embedding import generate_embedding
+from app.plugins.builtins.unified_search.search_engine import hybrid_search
+
+
+class UnifiedSearchContract:
+    """Public contract for the unified_search plugin."""
+
+    generate_embedding = staticmethod(generate_embedding)
+    hybrid_search = staticmethod(hybrid_search)
+
+
+_contract_instance: UnifiedSearchContract | None = None
+
+
+def get_contract() -> UnifiedSearchContract:
+    global _contract_instance
+    if _contract_instance is None:
+        _contract_instance = UnifiedSearchContract()
+    return _contract_instance

app/plugins/builtins/unified_search/embedding.py

@@ -40,7 +40,7 @@ async def _get_api_credentials(
     # Fallback to DB provider
     if db and tenant_id:
         try:
-            from app.plugins.builtins.ai_assistant.services import get_default_provider
+            from app.plugins.builtins.ai_assistant.contracts import get_default_provider
             provider = await get_default_provider(db, tenant_id)
             if provider and provider.api_key:
                 return provider.api_key, provider.base_url, provider.provider_type

app/plugins/builtins/unified_search/query_understanding.py

@@ -38,7 +38,7 @@ async def _get_api_credentials(
     """
     if db and tenant_id:
         try:
-            from app.plugins.builtins.ai_assistant.services import get_default_provider
+            from app.plugins.builtins.ai_assistant.contracts import get_default_provider
             provider = await get_default_provider(db, tenant_id)
             if provider and provider.api_key:
                 return provider.api_key, provider.base_url, provider.provider_type