Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

prestart.sh

@@ -1,16 +1,14 @@
 #!/bin/sh
 # =============================================================================
-# prestart.sh — Container entrypoint for CRM System
+# prestart.sh — Container entrypoint for CRM API container
 #
 # Responsibilities:
 #   1. Run Alembic DB migrations (alembic upgrade head).
-#   2. Start ARQ background worker in background.
-#   3. Start uvicorn as PID 1 (so signals like SIGTERM are forwarded correctly).
+#   2. Start uvicorn as PID 1 (so signals like SIGTERM are forwarded correctly).
 #
 # Notes:
 #   - `set -e` ensures the container crashes loudly if migrations fail.
-#   - ARQ worker runs in background, uvicorn becomes PID 1.
-#   - `--workers 1` is intentional for v1.
+#   - The ARQ worker runs in a separate container (see worker.sh / docker-compose).
 # =============================================================================
 
 set -e
@@ -19,9 +17,6 @@ echo "[prestart] $(date -u +%Y-%m-%dT%H:%M:%SZ) - Running alembic upgrade head..
 alembic upgrade head
 echo "[prestart] DB migrations completed successfully."
 
-echo "[prestart] Starting ARQ background worker..."
-arq app.core.worker.WorkerSettings &
-
 echo "[prestart] Starting uvicorn on 0.0.0.0:8000 (workers=1)..."
 exec uvicorn app.main:app \
     --host 0.0.0.0 \