Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/routes/auth.py

@@ -43,14 +43,14 @@ async def login(
         settings.rate_limit_login_window,
     )
 
-    result = await auth_service.login(db, redis, body.email, body.password)
+    result = await auth_service.login(db, redis, body.email, body.password, body.tenant_slug)
     if result is None:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail={"detail": "Invalid email or password", "code": "invalid_credentials"},
         )
 
-    session_id, csrf_token, user, tenant = result
+    session_id, csrf_token, user, tenant, role = result
 
     # Reset rate limit on success
     await reset_rate_limit(f"auth:login:{ip}:{body.email}")
@@ -74,7 +74,7 @@ async def login(
             "user_id": str(user.id),
             "email": user.email,
             "name": user.name,
-            "role": user.role,
+            "role": role,
             "is_system_admin": user.is_system_admin,
             "tenant_id": str(tenant.id),
             "tenant_name": tenant.name,