Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

worker.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# =============================================================================
+# worker.sh — Container entrypoint for ARQ background worker
+#
+# Responsibilities:
+#   1. Start the ARQ worker as PID 1 (so signals like SIGTERM are forwarded).
+#
+# Notes:
+#   - No migrations, no uvicorn — this container only processes background jobs.
+#   - The worker connects to the same Redis instance as the API container.
+#   - Cron jobs use a Redis-based distributed lock to prevent duplicate
+#     execution when multiple worker replicas are running.
+# =============================================================================
+
+set -e
+
+echo "[worker] $(date -u +%Y-%m-%dT%H:%M:%SZ) - Starting ARQ worker..."
+exec arq app.core.worker.WorkerSettings