fix: comprehensive system audit fixes (55+ issues)

CRITICAL:
- Fix SQL injection in prestart.sh (parameterized query)
- Fix secret key validation (always validate, not just production)
- Fix workspace model partial index bug (func.text -> text)
- Fix HealthResponse schema (add checks field)
- Fix Tenant import in permissions.py (NameError on every auth request)
- Fix README tech stack (React instead of Alpine.js)
- Delete broken test_cross_tenant_security_v2.py
- Add fail-closed RLS migration 0084 (48 tenant tables)

HIGH:
- Add GeneralRateLimitMiddleware for all API routes
- Add file type blocklist for DMS and attachment uploads
- Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass
- Fix CSRF bypass path matching (in -> endswith)
- Add worker healthcheck in docker-compose.yml
- Add ARQ max_tries=3 for job retries
- Fix 28 bare pass in mail services (-> logger.debug)
- Fix print() -> logger in main.py and ai_assistant
- Fix duplicate email handling (catch IntegrityError -> 409)
- Add session revocation (invalidate_all_user_sessions)
- Add resource limits to all containers
- Fix CORS default (localhost -> production domain)
- Fix SameSite=Lax -> Strict
- Fix Redis password visibility in healthcheck
- Fix npm vulnerabilities (19 -> 9)
- Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP)

MEDIUM:
- Localize ErrorBoundary to German
- Wire Mail.tsx save/delete filter to API
- Document system_notif plugin (no routes needed)
- Fix datetime.utcnow() -> datetime.now(UTC)
- Pin litellm version (>=1.0,<2.0)
- Move CSRF token from sessionStorage to in-memory
- Fix restore_backup error handling and transaction
- Fix Dms.tsx useEffect cleanup
- Add skip-to-content link for accessibility
- Add selectinload imports to 3 services
- Add .env.example missing variables
- Fix AppShell/TopBar/Sidebar test mocks

NEW TESTS:
- test_guest_auth.py (6 tests)
- test_user_service.py (8 tests)
- test_backup_service.py (5 tests)

NEW SCHEMAS:
- saved_filter, saved_view, user_preference, workspace, entity_policy

Tests: 22/22 PASSED

app/schemas/common.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from typing import Any
+
 from pydantic import BaseModel
 
 
@@ -14,6 +16,7 @@ class ErrorResponse(BaseModel):
 class HealthResponse(BaseModel):
     status: str
     version: str
+    checks: dict[str, Any] = {}
 
 
 class NotificationResponse(BaseModel):

app/schemas/entity_policy.py

@@ -0,0 +1,37 @@
+"""Schemas for EntityPolicy API endpoints."""
+
+from __future__ import annotations
+
+from typing import Any
+from pydantic import BaseModel
+
+
+class EntityPolicyBase(BaseModel):
+    name: str
+    entity_type: str
+    principal_type: str
+    principal_id: str
+    effect: str
+    conditions: dict[str, Any] | None = None
+    priority: int = 0
+    enabled: bool = True
+
+
+class EntityPolicyCreate(EntityPolicyBase):
+    pass
+
+
+class EntityPolicyUpdate(BaseModel):
+    name: str | None = None
+    effect: str | None = None
+    conditions: dict[str, Any] | None = None
+    priority: int | None = None
+    enabled: bool | None = None
+
+
+class EntityPolicyResponse(EntityPolicyBase):
+    id: str
+    created_at: str | None = None
+    updated_at: str | None = None
+
+    model_config = {"from_attributes": True}

app/schemas/saved_filter.py

@@ -0,0 +1,25 @@
+"""Schemas for SavedFilter API endpoints."""
+
+from __future__ import annotations
+
+from typing import Any
+from pydantic import BaseModel
+
+
+class SavedFilterBase(BaseModel):
+    name: str
+    entity_type: str
+    filter_criteria: dict[str, Any] = {}
+
+
+class SavedFilterCreate(SavedFilterBase):
+    pass
+
+
+class SavedFilterResponse(SavedFilterBase):
+    id: str
+    user_id: str
+    created_at: str | None = None
+    updated_at: str | None = None
+
+    model_config = {"from_attributes": True}

app/schemas/saved_view.py

@@ -0,0 +1,25 @@
+"""Schemas for SavedView API endpoints."""
+
+from __future__ import annotations
+
+from typing import Any
+from pydantic import BaseModel
+
+
+class SavedViewBase(BaseModel):
+    name: str
+    entity_type: str
+    view_config: dict[str, Any] = {}
+
+
+class SavedViewCreate(SavedViewBase):
+    pass
+
+
+class SavedViewResponse(SavedViewBase):
+    id: str
+    user_id: str
+    created_at: str | None = None
+    updated_at: str | None = None
+
+    model_config = {"from_attributes": True}

app/schemas/user_preference.py

@@ -0,0 +1,24 @@
+"""Schemas for UserPreference API endpoints."""
+
+from __future__ import annotations
+
+from typing import Any
+from pydantic import BaseModel
+
+
+class UserPreferenceBase(BaseModel):
+    key: str
+    value: Any = {}
+
+
+class UserPreferenceUpdate(BaseModel):
+    value: Any = {}
+
+
+class UserPreferenceResponse(UserPreferenceBase):
+    id: str
+    user_id: str
+    created_at: str | None = None
+    updated_at: str | None = None
+
+    model_config = {"from_attributes": True}

app/schemas/workspace.py

@@ -0,0 +1,45 @@
+"""Schemas for Workspace API endpoints."""
+
+from __future__ import annotations
+
+from pydantic import BaseModel
+
+
+class WorkspaceBase(BaseModel):
+    name: str
+    icon: str = "LayoutGrid"
+    description: str | None = None
+    is_default: bool = False
+    is_active: bool = True
+
+
+class WorkspaceCreate(WorkspaceBase):
+    pass
+
+
+class WorkspaceUpdate(BaseModel):
+    name: str | None = None
+    icon: str | None = None
+    description: str | None = None
+    is_default: bool | None = None
+    is_active: bool | None = None
+
+
+class WorkspaceResponse(WorkspaceBase):
+    id: str
+    created_by: str | None = None
+    created_at: str | None = None
+    updated_at: str | None = None
+
+    model_config = {"from_attributes": True}
+
+
+class WorkspaceModuleResponse(BaseModel):
+    id: str
+    workspace_id: str
+    module_key: str
+    is_visible: bool
+    menu_order: int
+    config: dict = {}
+
+    model_config = {"from_attributes": True}