Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

app/services/tenant_service.py

@@ -61,19 +61,23 @@ class TenantService:
         db: AsyncSession,
         tenant_id: uuid.UUID,
     ) -> list[dict[str, Any]]:
-        """List users in a tenant."""
-        q = select(User).where(User.tenant_id == tenant_id)
+        """List users in a tenant via UserTenant association."""
+        q = (
+            select(User, UserTenant)
+            .join(UserTenant, UserTenant.user_id == User.id)
+            .where(UserTenant.tenant_id == tenant_id)
+        )
         result = await db.execute(q)
-        users = result.scalars().all()
+        rows = result.all()
         return [
             {
                 "id": str(u.id),
                 "email": u.email,
                 "name": u.name,
-                "role": u.role,
+                "role": ut.role,
                 "is_active": u.is_active,
             }
-            for u in users
+            for u, ut in rows
         ]
 
     async def assign_user_to_tenant(