feat(permissions): ABAC integration, principals caching, cache version validation

- Integrate ABAC policies into apply_visibility_filter() (allow/deny with priority)
- Add field whitelist (ABAC_ALLOWED_FIELDS) for build_sql_condition() security
- Add request-level ContextVar for user principals (group_ids, role_id)
- Set principals in deps.py (session + bearer auth)
- Use ContextVar in visibility.py and permission_resolver.py (N+1 fix)
- Add version validation to get_cached_visible_ids() (cache strategy unification)
- Deactivate delegation route (parked — not integrated into resolve_permissions)
- Add 7 ABAC integration tests

All 70 tests pass (7 ABAC + 63 existing). No regressions.

app/main.py

@@ -66,7 +66,7 @@ from app.routes import (
     backups,
     owner_transfer,
     permission_templates,
-    delegations,
+    # delegations,  # ⏸ Parked — not integrated into resolve_permissions()
     policies,
     guests,
     outbox,
@@ -444,7 +444,7 @@ def create_app() -> FastAPI:
     app.include_router(saved_views.router)
     app.include_router(webhooks.router)
     app.include_router(permission_templates.router)
-    app.include_router(delegations.router)
+    # app.include_router(delegations.router)  # ⏸ Parked — not integrated into resolve_permissions()
     app.include_router(policies.router)
     app.include_router(errors.router)
     app.include_router(guests.router)  # ⚠️ Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest