Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

frontend/src/components/mail/SignatureManager.tsx

@@ -3,6 +3,7 @@
  * Supports placeholder variables for user/tenant data.
  */
 
+import DOMPurify from 'dompurify';
 import React, { useState, useEffect, useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useForm } from 'react-hook-form';
@@ -198,7 +199,7 @@ export function SignatureManager() {
                 <div className="flex-1">
                   <p className="font-medium text-secondary-900">{sig.name}</p>
                   {sig.is_default && <span className="text-xs text-primary-600">{t('mail.defaultSignature')}</span>}
-                  <p className="text-sm text-secondary-500 mt-1 truncate" dangerouslySetInnerHTML={{ __html: sig.body_html }} />
+                  <p className="text-sm text-secondary-500 mt-1 truncate" dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(sig.body_html) }} />
                 </div>
                 <div className="flex gap-2">
                   <Button variant="ghost" size="sm" onClick={() => handleEdit(sig)} data-testid={`edit-signature-${sig.id}`}>{t('common.edit')}</Button>