Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

tests/test_dms_coverage.py

@@ -360,7 +360,7 @@ class TestFileCoverage:
         assert resp.status_code == 400
 
     @pytest.mark.asyncio
-    async def test_preview_file_missing_on_disk(self, authed_client):
+    async def test_preview_file_missing_on_disk(self, authed_client, db_session):
         """GET /files/{id}/preview → 404 when file missing on disk."""
         client, _ = authed_client
         resp = await client.post(
@@ -369,10 +369,23 @@ class TestFileCoverage:
             headers=ORIGIN_HEADER,
         )
         file_id = resp.json()["id"]
-        storage_path = resp.json()["storage_path"]
+        assert "storage_path" not in resp.json()
 
-        if os.path.exists(storage_path):
-            os.remove(storage_path)
+        # Remove file from disk via storage backend
+        from app.core.storage import get_storage_backend
+
+        storage = get_storage_backend()
+        from sqlalchemy import select
+
+        from app.plugins.builtins.dms.models import File as DmsFile
+
+        # Need to get storage_path from DB (not exposed in API)
+        import uuid as _uuid
+
+        result = await db_session.execute(select(DmsFile).where(DmsFile.id == _uuid.UUID(file_id)))
+        dms_file = result.scalar_one_or_none()
+        if dms_file:
+            await storage.delete(dms_file.storage_path)
 
         resp = await client.get(f"/api/v1/dms/files/{file_id}/preview", headers=ORIGIN_HEADER)
         assert resp.status_code == 404