refactor(cleanup): remove dead GuestUser/GuestInvitation code and fix test imports

Deleted:
- app/models/guest_user.py
- app/models/guest_invitation.py
- app/routes/guest_auth.py (was orphaned, not imported)
- tests/test_guest_auth.py (tested removed guest auth system)

Modified:
- app/models/__init__.py: removed stale GuestUser/GuestInvitation comments
- app/services/entity_permission_service.py: updated guest permission comment
- tests/test_permission_system_live.py: replaced GuestUser with User+UserTenant(role=guest),
  changed principal_type from "guest" to "user", switched guest test from
  /api/v1/guest/login to regular /api/v1/auth/login endpoint

Frontend: no guest components found, nothing to clean up.
Alembic migrations: historical migrations referencing guest_users/guest_invitations
  tables are left intact (they document DB history).

app/models/__init__.py

@@ -13,8 +13,6 @@ from app.models.contact_merge import ContactMergeHistory
 from app.models.entity_permission import EntityPermission
 from app.models.consumer_inbox import ConsumerInbox
 from app.models.outbox_delivery import OutboxDelivery
-# ⚠️ Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest
-# GuestUser and GuestInvitation models removed — guests are now regular users
 from app.models.entity_policy import EntityPolicy
 from app.models.permission_template import PermissionTemplate
 from app.models.permission_delegation import PermissionDelegation

app/models/guest_invitation.py

@@ -1,43 +0,0 @@
-"""Guest invitation model — secure token-based invitations."""
-
-from __future__ import annotations
-
-import uuid
-from datetime import datetime
-
-from sqlalchemy import DateTime, ForeignKey, String, func
-from sqlalchemy.dialects.postgresql import UUID as PGUUID
-from sqlalchemy.orm import Mapped, mapped_column
-
-from app.core.db import Base
-
-
-class GuestInvitation(Base):
-    """Secure invitation token for guest users.
-
-    Token is a random 32-byte URL-safe string.
-    Only the hash is stored in the database.
-    One-time use: used_at is set on acceptance.
-    """
-
-    __tablename__ = "guest_invitations"
-
-    id: Mapped[uuid.UUID] = mapped_column(
-        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
-    )
-    guest_user_id: Mapped[uuid.UUID] = mapped_column(
-        PGUUID(as_uuid=True),
-        ForeignKey("guest_users.id", ondelete="CASCADE"),
-        nullable=False,
-        index=True,
-    )
-    token_hash: Mapped[str] = mapped_column(String(64), nullable=False, unique=True, index=True)
-    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
-    used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True, default=None)
-    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True, default=None)
-    created_by: Mapped[uuid.UUID | None] = mapped_column(
-        PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
-    )
-    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )

app/models/guest_user.py

@@ -1,60 +0,0 @@
-"""Guest User model — for time-limited guest access via entity permissions."""
-
-from __future__ import annotations
-
-import uuid
-from datetime import datetime
-
-from sqlalchemy import DateTime, ForeignKey, Index, String, func
-from sqlalchemy.dialects.postgresql import UUID as PGUUID
-from sqlalchemy.orm import Mapped, mapped_column
-
-from app.core.db import Base, TenantMixin
-
-
-class GuestUser(Base, TenantMixin):
-    """Guest user with time-limited access to shared entities.
-
-    Guests are invited by tenant admins and can only access entities
-    that have explicit entity_permissions with principal_type='guest'.
-    """
-
-    __tablename__ = "guest_users"
-    __table_args__ = (
-        Index("ix_guest_users_email_tenant", "email", "tenant_id", unique=True),
-        Index("ix_guest_users_status", "status", "tenant_id"),
-        Index("ix_guest_users_invited_by", "invited_by"),
-    )
-
-    id: Mapped[uuid.UUID] = mapped_column(
-        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
-    )
-    email: Mapped[str] = mapped_column(String(255), nullable=False)
-    name: Mapped[str] = mapped_column(String(255), nullable=False)
-    password_hash: Mapped[str | None] = mapped_column(
-        String(255), nullable=True, default=None
-    )
-    tenant_id: Mapped[uuid.UUID] = mapped_column(
-        PGUUID(as_uuid=True),
-        ForeignKey("tenants.id", ondelete="CASCADE"),
-        nullable=False,
-        index=True,
-    )
-    invited_by: Mapped[uuid.UUID | None] = mapped_column(
-        PGUUID(as_uuid=True),
-        ForeignKey("users.id", ondelete="SET NULL"),
-        nullable=True,
-    )
-    status: Mapped[str] = mapped_column(
-        String(20), nullable=False, default="invited"
-    )  # 'invited', 'active', 'expired', 'revoked'
-    expires_at: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True, default=None
-    )
-    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now()
-    )
-    updated_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default=func.now(),
-        onupdate=func.now(),
-    )