feat: Plugin-System Umbau — 6 Phasen komplett abgeschlossen

Phase 1: Contracts konsequent nutzen
- 12 neue contracts.py erstellt (alle 19 Plugins haben jetzt contracts)
- 4 bestehende contracts.py an zentrale ContractRegistry angepasst
- Alle 19 Plugins haben on_deactivate mit Contract-Unregister
- 0 echte problematische INTER-Plugin Imports

Phase 2: Hooks/Filters-System
- app/core/hooks.py (HookRegistry mit actions + filters)
- 15 Hook-Punkte in Core-Services (contact, auth, mail, calendar, user, dms)
- BasePlugin.on_deactivate meldet alle Hooks ab

Phase 3: Plugin-Isolation
- scripts/check_cross_plugin_imports.py (Linting-Regel)
- .github/workflows/check-cross-plugin-imports.yml (CI/CD)
- .pre-commit-cross-plugin.yaml (Pre-commit Hook)
- 155 Dateien geprueft, 0 Verstoesse

Phase 4: Plugin-Versioning
- app/plugins/semver.py (SemVer mit Parse, Compare, Pre-release)
- migration_runner.py erweitert: run_migration_down, rollback_to_version
- manifest.py: min_app_version Feld
- registry.py: App-Version-Compatibility-Check bei Installation
- GET /api/v1/plugins/updates Endpoint

Phase 5: Marketplace-Vorbereitung
- app/plugins/signature.py (Ed25519 Signatur-Validierung)
- app/plugins/quarantine.py (Plugin-Quarantine mit Validierung)
- app/models/plugin_allowlist.py + Migration 0046
- manifest.py: author, license, homepage, icon, screenshots, changelog, marketplace_tags, price
- registry.py: discover_external(), discover_all()
- POST /api/v1/plugins/install-marketplace (deaktiviert)

Phase 6: Manifest-Anpassung
- manifest.py: 12 neue Felder + SemVer/Hook-Name Validierung
- MANIFEST_SCHEMA_DOC aktualisiert
- Alle 19 Plugin-Manifeste aktualisiert
- Frontend PluginUiManifest Typ erweitert

Zusaetzliche Bug-Fixes:
- test_sample-Modul erstellt
- conftest.py Deadlock-Prevention
- SESSION_COOKIE_SECURE=true
- dump.rdb aus Git entfernt + .gitignore
- backup.py datetime.utcnow -> func.now()
- system_settings.py JSONB-Import nach oben
- tax.py Mapped[float] -> Mapped[Decimal]
- notification.py type_key-Laengen vereinheitlicht

Tests: 91 neue Tests, alle bestanden

app/plugins/signature.py

@@ -0,0 +1,128 @@
+"""Plugin signature verification for external plugins.
+
+Uses Ed25519 signatures to verify that a plugin ZIP package
+has not been tampered with and comes from a trusted source.
+
+Usage::
+
+    from app.plugins.signature import PluginSignature
+
+    # Verify a downloaded plugin
+    is_valid = PluginSignature.verify_signature(
+        zip_path=Path("plugin.zip"),
+        signature=b"...",
+        public_key=b"...",
+    )
+
+    # Compute hash for allowlist
+    file_hash = PluginSignature.compute_hash(Path("plugin.zip"))
+
+    # Sign a plugin (for plugin authors)
+    signature = PluginSignature.sign_plugin(
+        zip_path=Path("plugin.zip"),
+        private_key=b"...",
+    )
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+
+class PluginSignature:
+    """Verify plugin package signatures using Ed25519."""
+
+    @staticmethod
+    def compute_hash(file_path: Path) -> str:
+        """Compute SHA-256 hash of a file.
+
+        Args:
+            file_path: Path to the file to hash.
+
+        Returns:
+            Hex-encoded SHA-256 hash string.
+        """
+        sha256 = hashlib.sha256()
+        with open(file_path, "rb") as f:
+            for chunk in iter(lambda: f.read(8192), b""):
+                sha256.update(chunk)
+        return sha256.hexdigest()
+
+    @staticmethod
+    def verify_signature(
+        zip_path: Path,
+        signature: bytes,
+        public_key: bytes,
+    ) -> bool:
+        """Verify Ed25519 signature of a plugin ZIP.
+
+        Args:
+            zip_path: Path to the plugin ZIP file.
+            signature: The Ed25519 signature bytes.
+            public_key: The Ed25519 public key bytes.
+
+        Returns:
+            True if the signature is valid, False otherwise.
+        """
+        try:
+            from nacl.signing import VerifyKey
+            from nacl.exceptions import BadSignatureError
+
+            file_hash = PluginSignature.compute_hash(zip_path)
+            verify_key = VerifyKey(public_key)
+            verify_key.verify(file_hash.encode(), signature)
+            logger.info("Signature verified for %s", zip_path.name)
+            return True
+        except ImportError:
+            logger.warning(
+                "PyNaCl not installed — signature verification disabled. "
+                "Install with: pip install pynacl"
+            )
+            return False
+        except BadSignatureError:
+            logger.warning("Invalid signature for %s", zip_path.name)
+            return False
+        except Exception:
+            logger.exception("Error verifying signature for %s", zip_path.name)
+            return False
+
+    @staticmethod
+    def sign_plugin(
+        zip_path: Path,
+        private_key: bytes,
+    ) -> bytes:
+        """Sign a plugin ZIP with an Ed25519 private key.
+
+        Args:
+            zip_path: Path to the plugin ZIP file.
+            private_key: The Ed25519 private key bytes.
+
+        Returns:
+            The Ed25519 signature bytes.
+
+        Raises:
+            ImportError: If PyNaCl is not installed.
+        """
+        from nacl.signing import SigningKey
+
+        file_hash = PluginSignature.compute_hash(zip_path)
+        signing_key = SigningKey(private_key)
+        return signing_key.sign(file_hash.encode()).signature
+
+    @staticmethod
+    def generate_keypair() -> tuple[bytes, bytes]:
+        """Generate a new Ed25519 key pair.
+
+        Returns:
+            Tuple of (private_key, public_key) bytes.
+        """
+        from nacl.signing import SigningKey
+
+        signing_key = SigningKey.generate()
+        private_key = bytes(signing_key)
+        public_key = bytes(signing_key.verify_key)
+        return private_key, public_key