feat: Plugin-System Umbau — 6 Phasen komplett abgeschlossen

Phase 1: Contracts konsequent nutzen
- 12 neue contracts.py erstellt (alle 19 Plugins haben jetzt contracts)
- 4 bestehende contracts.py an zentrale ContractRegistry angepasst
- Alle 19 Plugins haben on_deactivate mit Contract-Unregister
- 0 echte problematische INTER-Plugin Imports

Phase 2: Hooks/Filters-System
- app/core/hooks.py (HookRegistry mit actions + filters)
- 15 Hook-Punkte in Core-Services (contact, auth, mail, calendar, user, dms)
- BasePlugin.on_deactivate meldet alle Hooks ab

Phase 3: Plugin-Isolation
- scripts/check_cross_plugin_imports.py (Linting-Regel)
- .github/workflows/check-cross-plugin-imports.yml (CI/CD)
- .pre-commit-cross-plugin.yaml (Pre-commit Hook)
- 155 Dateien geprueft, 0 Verstoesse

Phase 4: Plugin-Versioning
- app/plugins/semver.py (SemVer mit Parse, Compare, Pre-release)
- migration_runner.py erweitert: run_migration_down, rollback_to_version
- manifest.py: min_app_version Feld
- registry.py: App-Version-Compatibility-Check bei Installation
- GET /api/v1/plugins/updates Endpoint

Phase 5: Marketplace-Vorbereitung
- app/plugins/signature.py (Ed25519 Signatur-Validierung)
- app/plugins/quarantine.py (Plugin-Quarantine mit Validierung)
- app/models/plugin_allowlist.py + Migration 0046
- manifest.py: author, license, homepage, icon, screenshots, changelog, marketplace_tags, price
- registry.py: discover_external(), discover_all()
- POST /api/v1/plugins/install-marketplace (deaktiviert)

Phase 6: Manifest-Anpassung
- manifest.py: 12 neue Felder + SemVer/Hook-Name Validierung
- MANIFEST_SCHEMA_DOC aktualisiert
- Alle 19 Plugin-Manifeste aktualisiert
- Frontend PluginUiManifest Typ erweitert

Zusaetzliche Bug-Fixes:
- test_sample-Modul erstellt
- conftest.py Deadlock-Prevention
- SESSION_COOKIE_SECURE=true
- dump.rdb aus Git entfernt + .gitignore
- backup.py datetime.utcnow -> func.now()
- system_settings.py JSONB-Import nach oben
- tax.py Mapped[float] -> Mapped[Decimal]
- notification.py type_key-Laengen vereinheitlicht

Tests: 91 neue Tests, alle bestanden

app/plugins/builtins/dms/contracts.py

@@ -2,16 +2,25 @@
 
 from __future__ import annotations
 
+from app.plugins.builtins.contracts import get_contract_registry
 from app.plugins.builtins.dms.models import File as DmsFile, Folder
 
 
 class DmsContract:
     """Public contract for the DMS plugin."""
 
+    contract_name = "dms"
+
     DmsFile = DmsFile
     Folder = Folder
 
 
+# ─── self-registration ───
+
+_contract = DmsContract()
+get_contract_registry().register("dms", _contract)
+
+# Backward-compatible local accessor
 _contract_instance: DmsContract | None = None
 
 
@@ -20,3 +29,6 @@ def get_contract() -> DmsContract:
     if _contract_instance is None:
         _contract_instance = DmsContract()
     return _contract_instance
+
+
+__all__ = ["DmsContract", "DmsFile", "Folder"]

app/plugins/builtins/dms/plugin.py

@@ -42,4 +42,17 @@ class DmsPlugin(BasePlugin):
         detail_tabs=[
             FrontendDetailTab(entity_type='contact', label_key='tabs.files', label='Dateien', component='@/components/contact/ContactFilesTab', icon='FolderOpen', order=40, permission='dms:read'),
         ],
+        author="LeoCRM Team",
+        min_app_version="1.0.0",
+        hooks=["dms.before_upload"],
+        contract_version="1.0.0",
     )
+
+    async def on_deactivate(
+        self, db, service_container, event_bus
+    ) -> None:
+        """Deactivate plugin: unregister contract and event listeners."""
+        # Contract abmelden
+        from app.plugins.builtins.contracts import get_contract_registry
+        get_contract_registry().unregister(self.manifest.name)
+        await super().on_deactivate(db, service_container, event_bus)

app/plugins/builtins/dms/routes.py

@@ -35,7 +35,10 @@ from app.plugins.builtins.dms.schemas import (
     ShareRequest,
 )
 from app.plugins.builtins.permissions.contracts import get_contract as get_perms_contract
-from app.plugins.builtins.permissions.models import Permission  # TODO: migrate to contract
+
+# Get Permission model from the permissions contract
+_perms_contract = get_perms_contract()
+Permission = _perms_contract.Permission
 
 router = APIRouter(prefix="/api/v1/dms", tags=["dms"])
 
@@ -461,6 +464,14 @@ async def upload_file(
             sha256.update(chunk)
             yield chunk
 
+    # ── Hook: dms.before_upload (Filter) — can modify filename ──
+    from app.core.hooks import apply_filters
+    upload_data = {
+        "filename": file.filename or "unnamed",
+        "mime_type": file.content_type or "application/octet-stream",
+    }
+    upload_data = await apply_filters("dms.before_upload", upload_data)
+
     # Create file record
     file_id = uuid.uuid4()
     storage_path = _file_storage_path(tenant_id, file_id)
@@ -471,12 +482,12 @@ async def upload_file(
 
     content_hash = sha256.hexdigest()
 
-    mime_type = file.content_type or "application/octet-stream"
+    mime_type = upload_data["mime_type"]
 
     dms_file = DmsFile(
         id=file_id,
         tenant_id=tenant_id,
-        name=file.filename or "unnamed",
+        name=upload_data["filename"],
         folder_id=fid,
         uploaded_by=user_id,
         mime_type=mime_type,