Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

tests/test_tenant.py

@@ -178,17 +178,15 @@ class TestFieldPermissions:
         from app.models.user import User, UserTenant
 
         sales_user = User(
-            tenant_id=seed["tenant_a"].id,
             email="sales@tenanta.com",
             name="Sales Rep",
             password_hash=hash_password("TestPass123!"),
-            role="sales_rep",
             is_active=True,
             preferences={},
         )
         db_session.add(sales_user)
         await db_session.flush()
-        ut = UserTenant(user_id=sales_user.id, tenant_id=seed["tenant_a"].id, is_default=True)
+        ut = UserTenant(user_id=sales_user.id, tenant_id=seed["tenant_a"].id, is_default=True, role="sales_rep")
         db_session.add(ut)
         await db_session.commit()