Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

tests/test_dms.py

@@ -6,8 +6,6 @@ permissions plugin public share endpoints.
 
 from __future__ import annotations
 
-import os
-
 import pytest
 
 from tests.conftest import ORIGIN_HEADER, login_client
@@ -206,10 +204,9 @@ async def test_ac5_upload_file(authed_client):
     assert data["size_bytes"] == len(PDF_CONTENT)
     assert data["folder_id"] is None
     assert "id" in data
-    assert "storage_path" in data
-
-    # Verify file exists on disk
-    assert os.path.exists(data["storage_path"])
+    assert "content_hash" in data
+    assert len(data["content_hash"]) == 64
+    assert "storage_path" not in data
 
 
 @pytest.mark.asyncio