fix: comprehensive system audit fixes (55+ issues)

CRITICAL:
- Fix SQL injection in prestart.sh (parameterized query)
- Fix secret key validation (always validate, not just production)
- Fix workspace model partial index bug (func.text -> text)
- Fix HealthResponse schema (add checks field)
- Fix Tenant import in permissions.py (NameError on every auth request)
- Fix README tech stack (React instead of Alpine.js)
- Delete broken test_cross_tenant_security_v2.py
- Add fail-closed RLS migration 0084 (48 tenant tables)

HIGH:
- Add GeneralRateLimitMiddleware for all API routes
- Add file type blocklist for DMS and attachment uploads
- Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass
- Fix CSRF bypass path matching (in -> endswith)
- Add worker healthcheck in docker-compose.yml
- Add ARQ max_tries=3 for job retries
- Fix 28 bare pass in mail services (-> logger.debug)
- Fix print() -> logger in main.py and ai_assistant
- Fix duplicate email handling (catch IntegrityError -> 409)
- Add session revocation (invalidate_all_user_sessions)
- Add resource limits to all containers
- Fix CORS default (localhost -> production domain)
- Fix SameSite=Lax -> Strict
- Fix Redis password visibility in healthcheck
- Fix npm vulnerabilities (19 -> 9)
- Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP)

MEDIUM:
- Localize ErrorBoundary to German
- Wire Mail.tsx save/delete filter to API
- Document system_notif plugin (no routes needed)
- Fix datetime.utcnow() -> datetime.now(UTC)
- Pin litellm version (>=1.0,<2.0)
- Move CSRF token from sessionStorage to in-memory
- Fix restore_backup error handling and transaction
- Fix Dms.tsx useEffect cleanup
- Add skip-to-content link for accessibility
- Add selectinload imports to 3 services
- Add .env.example missing variables
- Fix AppShell/TopBar/Sidebar test mocks

NEW TESTS:
- test_guest_auth.py (6 tests)
- test_user_service.py (8 tests)
- test_backup_service.py (5 tests)

NEW SCHEMAS:
- saved_filter, saved_view, user_preference, workspace, entity_policy

Tests: 22/22 PASSED

frontend/src/pages/Dms.tsx

@@ -123,6 +123,8 @@ export function DmsPage() {
   useEffect(() => {
     loadFolders();
     loadSharedFiles();
+    // Cleanup: reset race condition guard on unmount
+    return () => { currentLoadId.current = ''; };
   }, [loadFolders, loadSharedFiles]);
 
   // Load files based on current selection

frontend/src/pages/Mail.tsx

@@ -23,7 +23,7 @@ import { MailFilterPanel, type FilterState as MailFilterState, emptyFilterState
 import { MailSortPanel, type SortState as MailSortState, emptySortState as emptyMailSortState, applySorting as applyMailSorting } from '@/components/mail/MailSortPanel';
 import { MailGroupPanel, type GroupState as MailGroupState, emptyGroupState as emptyMailGroupState, applyGrouping as applyMailGrouping, type GroupedMails } from '@/components/mail/MailGroupPanel';
 import type { Tag } from '@/api/tags';
-import { useSavedFilters } from '@/api/savedFilters';
+import { useSavedFilters, useCreateSavedFilter, useDeleteSavedFilter } from '@/api/savedFilters';
 import {
   fetchAccounts,
   fetchFolders,
@@ -90,6 +90,8 @@ export function MailPage() {
   const [isSyncing, setIsSyncing] = useState(false);
   const [selectedTags, setSelectedTags] = useState<Tag[]>([]);
   const { data: savedFilters } = useSavedFilters('mail');
+  const createSavedFilter = useCreateSavedFilter();
+  const deleteSavedFilter = useDeleteSavedFilter();
   const [mailFilterState, setMailFilterState] = useState<MailFilterState>(emptyMailFilterState);
   const [mailSortState, setMailSortState] = useState<MailSortState>(emptyMailSortState);
   const [mailGroupState, setMailGroupState] = useState<MailGroupState>(emptyMailGroupState);
@@ -635,13 +637,15 @@ export function MailPage() {
             onFiltersChange={setMailFilterState}
             savedFilters={(savedFilters || []).map((f: any) => ({ id: f.id, name: f.name, filterState: f.filter_criteria || emptyMailFilterState }))}
             onSaveFilter={(name, state) => {
-              // TODO: save via API
-              console.log('Save filter', name, state);
+              createSavedFilter.mutate({
+                name,
+                entity_type: 'mail',
+                filter_criteria: state,
+              });
             }}
             onLoadFilter={(state) => setMailFilterState(state)}
             onDeleteFilter={(id) => {
-              // TODO: delete via API
-              console.log('Delete filter', id);
+              deleteSavedFilter.mutate(id);
             }}
           />
         ),