Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

tests/conftest.py

@@ -82,6 +82,7 @@ from app.plugins.builtins.report_generator.models import (  # noqa: F401
 from app.plugins.builtins.tags.models import Tag, TagAssignment  # noqa: F401
 from app.plugins.builtins.tasks import TasksPlugin  # noqa: F401
 from app.plugins.builtins.tasks.models import Task  # noqa: F401
+from app.models.outbox import EventOutbox  # noqa: F401
 from app.models.saved_filter import SavedFilter  # noqa: F401
 from app.plugins.registry import reset_registry_for_testing  # noqa: F401
 from app.services.plugin_service import reset_plugin_service_for_testing  # noqa: F401
@@ -137,15 +138,25 @@ def db_setup():
 
 @pytest.fixture(autouse=True)
 def clean_tables(db_setup):
-    """Clean all table data before each test (preserve schema)."""
+    """Clean all table data before each test (preserve schema).
+
+    Dynamically builds the TRUNCATE list from tables that actually exist
+    in the database, so plugin tables that were not created (e.g. when
+    only core model tables are present) do not cause errors.
+    """
     sync_eng = _get_sync_engine()
     with sync_eng.connect() as conn:
-        # TRUNCATE all tables with CASCADE — fast and reliable isolation
-        conn.execute(
+        # Query existing table names from information_schema
+        result = conn.execute(
             text(
-                "TRUNCATE TABLE report_instances, report_templates, contact_pgp_keys, pgp_keys, mail_account_send_permissions, mail_account_delegates, mail_seen_by, vacation_sent_log, mail_signatures, mail_templates, mail_rules, mail_label_assignments, mail_labels, mail_attachments, mails, mail_folders, mail_accounts, resource_bookings, resources, subtasks, user_calendar_visibility, calendar_shares, calendar_entry_links, calendar_entries, calendars, files, folders, entity_links, share_links, permissions, tag_assignments, tags, workflow_step_history, workflow_instances, workflows, ai_messages, ai_conversations, plugin_migrations, plugins, contacts, api_tokens, password_reset_tokens, notifications, deletion_log, audit_log, sessions, roles, user_tenants, users, tenants CASCADE;"
+                "SELECT table_name FROM information_schema.tables "
+                "WHERE table_schema = 'public' AND table_type = 'BASE TABLE';"
             )
         )
+        existing_tables = [row[0] for row in result]
+        if existing_tables:
+            table_list = ", ".join(existing_tables)
+            conn.execute(text(f"TRUNCATE TABLE {table_list} CASCADE;"))
         conn.commit()
     sync_eng.dispose()
     yield
@@ -218,41 +229,33 @@ async def seed_tenant_and_users(db: AsyncSession) -> dict[str, Any]:
 
     # Admin in tenant A
     admin_a = User(
-        tenant_id=tenant_a.id,
         email="admin@tenanta.com",
         name="Admin A",
         password_hash=hash_password("TestPass123!"),
-        role="admin",
         is_active=True,
         preferences={},
     )
     # Viewer in tenant A
     viewer_a = User(
-        tenant_id=tenant_a.id,
         email="viewer@tenanta.com",
         name="Viewer A",
         password_hash=hash_password("TestPass123!"),
-        role="viewer",
         is_active=True,
         preferences={},
     )
     # Editor in tenant A
     editor_a = User(
-        tenant_id=tenant_a.id,
         email="editor@tenanta.com",
         name="Editor A",
         password_hash=hash_password("TestPass123!"),
-        role="editor",
         is_active=True,
         preferences={},
     )
     # Admin in tenant B
     admin_b = User(
-        tenant_id=tenant_b.id,
         email="admin@tenantb.com",
         name="Admin B",
         password_hash=hash_password("TestPass123!"),
-        role="admin",
         is_active=True,
         preferences={},
     )
@@ -260,12 +263,12 @@ async def seed_tenant_and_users(db: AsyncSession) -> dict[str, Any]:
     await db.flush()
 
     # User-tenant memberships
-    ut1 = UserTenant(user_id=admin_a.id, tenant_id=tenant_a.id, is_default=True)
-    ut2 = UserTenant(user_id=viewer_a.id, tenant_id=tenant_a.id, is_default=True)
-    ut3 = UserTenant(user_id=editor_a.id, tenant_id=tenant_a.id, is_default=True)
-    ut4 = UserTenant(user_id=admin_b.id, tenant_id=tenant_b.id, is_default=True)
+    ut1 = UserTenant(user_id=admin_a.id, tenant_id=tenant_a.id, is_default=True, role="admin")
+    ut2 = UserTenant(user_id=viewer_a.id, tenant_id=tenant_a.id, is_default=True, role="viewer")
+    ut3 = UserTenant(user_id=editor_a.id, tenant_id=tenant_a.id, is_default=True, role="editor")
+    ut4 = UserTenant(user_id=admin_b.id, tenant_id=tenant_b.id, is_default=True, role="admin")
     # Admin A is also member of tenant B (for switch-tenant test)
-    ut5 = UserTenant(user_id=admin_a.id, tenant_id=tenant_b.id, is_default=False)
+    ut5 = UserTenant(user_id=admin_a.id, tenant_id=tenant_b.id, is_default=False, role="admin")
     db.add_all([ut1, ut2, ut3, ut4, ut5])
     await db.flush()