Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/services/dedup_service.py

@@ -218,7 +218,7 @@ def _serialize_full(c: Contact) -> dict:
         "name": c.name,
         "firstname": c.firstname,
         "surname": c.surname,
-        "surfix": c.surfix,
+        "suffix": c.suffix,
         "email_1": c.email_1,
         "email_2": c.email_2,
         "phone_1": c.phone_1,
@@ -287,7 +287,6 @@ async def merge_contacts(
                 setattr(target, key, value)
 
     # Re-point entity_links from source to target
-    from app.models.entity_link import EntityLink
     await db.execute(
         text(
             "UPDATE entity_links SET entity_id = :target_id "
@@ -297,7 +296,6 @@ async def merge_contacts(
     )
 
     # Re-point tag_assignments from source to target
-    from app.models.tag import TagAssignment
     await db.execute(
         text(
             "UPDATE tag_assignments SET entity_id = :target_id "
@@ -309,7 +307,7 @@ async def merge_contacts(
     # Re-point contact_persons from source to target
     await db.execute(
         text(
-            "UPDATE contact_persons SET contact_id = :target_id "
+            "UPDATE contactpersons SET contact_id = :target_id "
             "WHERE contact_id = :source_id AND tenant_id = :tenant_id"
         ),
         {"target_id": target_uuid, "source_id": source_uuid, "tenant_id": tenant_id},
@@ -322,20 +320,37 @@ async def merge_contacts(
     # Record merge history
     history = ContactMergeHistory(
         tenant_id=tenant_id,
-        user_id=user_id,
-        source_id=source_uuid,
-        target_id=target_uuid,
+        merged_by=user_id,
+        source_contact_id=source_uuid,
+        target_contact_id=target_uuid,
         note=note,
     )
     db.add(history)
     await db.flush()
 
+    # Determine which fields were actually overridden
+    merged_fields = field_overrides or {}
+    if not merged_fields:
+        # Auto-merge: fill empty target fields from source
+        for attr in ("email_1", "email_2", "phone_1", "phone_2", "website",
+                      "mailing_street", "mailing_postalcode", "mailing_city",
+                      "mailing_country", "code", "vat_code"):
+            target_val = getattr(target, attr, None)
+            source_val = getattr(source, attr, None)
+            if not target_val and source_val:
+                setattr(target, attr, source_val)
+                merged_fields[attr] = source_val
+
+    history.merged_fields = merged_fields
+    await db.flush()
+
     return {
         "history": {
             "id": str(history.id),
             "source_id": source_id,
             "target_id": target_id,
             "note": note,
+            "merged_fields": merged_fields,
             "created_at": history.created_at.isoformat() if history.created_at else None,
         },
         "target_contact": _serialize_full(target),