Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

tests/test_auth.py

@@ -144,7 +144,16 @@ class TestSwitchTenant:
     async def test_switch_tenant_returns_200(self, client: AsyncClient, db_session):
         """AC 9: POST /api/v1/auth/switch-tenant -> 200, session tenant_id updated."""
         await seed_tenant_and_users(db_session)
-        await login_client(client, "admin@tenanta.com")
+        # Login and extract csrf_token from response body
+        login_resp = await client.post(
+            "/api/v1/auth/login",
+            json={"email": "admin@tenanta.com", "password": "TestPass123!"},
+            headers=ORIGIN_HEADER,
+        )
+        assert login_resp.status_code == 200
+        csrf_token = login_resp.json().get("csrf_token", "")
+        if csrf_token:
+            client.headers.update({"X-CSRF-Token": csrf_token})
 
         # Get initial tenant
         resp = await client.get("/api/v1/auth/me")
@@ -164,7 +173,7 @@ class TestSwitchTenant:
         resp = await client.post(
             "/api/v1/auth/switch-tenant",
             json={"tenant_id": str(tenant_b.id)},
-            headers=ORIGIN_HEADER,
+            headers={**ORIGIN_HEADER, "X-CSRF-Token": csrf_token} if csrf_token else ORIGIN_HEADER,
         )
         assert resp.status_code == 200
         assert resp.json()["tenant_id"] == str(tenant_b.id)