feat: Plugin-System Umbau — 6 Phasen komplett abgeschlossen

Phase 1: Contracts konsequent nutzen
- 12 neue contracts.py erstellt (alle 19 Plugins haben jetzt contracts)
- 4 bestehende contracts.py an zentrale ContractRegistry angepasst
- Alle 19 Plugins haben on_deactivate mit Contract-Unregister
- 0 echte problematische INTER-Plugin Imports

Phase 2: Hooks/Filters-System
- app/core/hooks.py (HookRegistry mit actions + filters)
- 15 Hook-Punkte in Core-Services (contact, auth, mail, calendar, user, dms)
- BasePlugin.on_deactivate meldet alle Hooks ab

Phase 3: Plugin-Isolation
- scripts/check_cross_plugin_imports.py (Linting-Regel)
- .github/workflows/check-cross-plugin-imports.yml (CI/CD)
- .pre-commit-cross-plugin.yaml (Pre-commit Hook)
- 155 Dateien geprueft, 0 Verstoesse

Phase 4: Plugin-Versioning
- app/plugins/semver.py (SemVer mit Parse, Compare, Pre-release)
- migration_runner.py erweitert: run_migration_down, rollback_to_version
- manifest.py: min_app_version Feld
- registry.py: App-Version-Compatibility-Check bei Installation
- GET /api/v1/plugins/updates Endpoint

Phase 5: Marketplace-Vorbereitung
- app/plugins/signature.py (Ed25519 Signatur-Validierung)
- app/plugins/quarantine.py (Plugin-Quarantine mit Validierung)
- app/models/plugin_allowlist.py + Migration 0046
- manifest.py: author, license, homepage, icon, screenshots, changelog, marketplace_tags, price
- registry.py: discover_external(), discover_all()
- POST /api/v1/plugins/install-marketplace (deaktiviert)

Phase 6: Manifest-Anpassung
- manifest.py: 12 neue Felder + SemVer/Hook-Name Validierung
- MANIFEST_SCHEMA_DOC aktualisiert
- Alle 19 Plugin-Manifeste aktualisiert
- Frontend PluginUiManifest Typ erweitert

Zusaetzliche Bug-Fixes:
- test_sample-Modul erstellt
- conftest.py Deadlock-Prevention
- SESSION_COOKIE_SECURE=true
- dump.rdb aus Git entfernt + .gitignore
- backup.py datetime.utcnow -> func.now()
- system_settings.py JSONB-Import nach oben
- tax.py Mapped[float] -> Mapped[Decimal]
- notification.py type_key-Laengen vereinheitlicht

Tests: 91 neue Tests, alle bestanden

app/services/auth_service.py

@@ -23,6 +23,7 @@ from app.core.auth import (
     update_session_tenant,
     verify_password,
 )
+from app.core.hooks import do_action, apply_filters
 from app.models.auth import PasswordResetToken
 from app.models.tenant import Tenant
 from app.models.user import User, UserTenant
@@ -48,6 +49,9 @@ class AuthService:
         The tenant is resolved from UserTenant via tenant_slug or the
         user's default tenant membership.
         """
+        # Hook: auth.before_login — filter can modify email
+        email = await apply_filters("auth.before_login", email, db=db, password=password, tenant_slug=tenant_slug)
+
         # Find user by email (globally unique now)
         q = select(User).where(User.email == email, User.is_active == True)  # noqa: E712
         result = await db.execute(q)
@@ -98,6 +102,9 @@ class AuthService:
             changes={"email": email},
         )
 
+        # Hook: auth.after_login
+        await do_action("auth.after_login", db=db, user=user, tenant=tenant, role=user_tenant.role, session_id=session_id)
+
         return session_id, csrf_token, user, tenant, user_tenant.role
 
     async def logout(self, redis: aioredis.Redis, session_id: str) -> bool:

app/services/contact_service.py

@@ -13,6 +13,7 @@ from sqlalchemy.orm import selectinload
 
 from app.models.contact import Contact, ContactPerson
 from app.services.entity_history_service import record_history
+from app.core.hooks import do_action, apply_filters
 
 
 def _compute_displayname(data: dict) -> str:
@@ -212,7 +213,9 @@ async def create_contact(
     db: AsyncSession, tenant_id: uuid.UUID, user_id: uuid.UUID, data: dict
 ) -> dict:
     """Create a new contact."""
-    data["displayname"] = _compute_displayname(data)
+    data["displayname"] = await apply_filters("contact.format_display_name", _compute_displayname(data), data=data, db=db, tenant_id=tenant_id, user_id=user_id)
+    # Hook: contact.before_create
+    await do_action("contact.before_create", data, db=db, tenant_id=tenant_id, user_id=user_id)
     contact_persons_data = data.pop("contact_persons", None)
 
     contact = Contact(
@@ -267,6 +270,9 @@ async def create_contact(
             'user_id': str(user_id),
         })
 
+    # Hook: contact.after_create
+    await do_action("contact.after_create", serialized, db=db, tenant_id=tenant_id, user_id=user_id)
+
     return serialized
 
 
@@ -290,6 +296,9 @@ async def update_contact(
     if not contact:
         raise ValueError("Contact not found")
 
+    # Hook: contact.before_update
+    await do_action("contact.before_update", data, db=db, tenant_id=tenant_id, user_id=user_id, contact_id=contact_id)
+
     # Capture snapshot before update
     snapshot_before = _serialize_contact_detail(contact)
 
@@ -340,6 +349,9 @@ async def update_contact(
         'type': contact.type,
     })
 
+    # Hook: contact.after_update
+    await do_action("contact.after_update", snapshot_after, db=db, tenant_id=tenant_id, user_id=user_id, contact_id=contact_id)
+
     return snapshot_after
 
 
@@ -357,6 +369,9 @@ async def delete_contact(
     if not contact:
         raise ValueError("Contact not found")
 
+    # Hook: contact.before_delete
+    await do_action("contact.before_delete", db=db, tenant_id=tenant_id, contact_id=contact_id, user_id=user_id)
+
     # Capture snapshot before deletion
     from sqlalchemy.orm import selectinload
     q2 = (

app/services/user_service.py

@@ -104,6 +104,11 @@ class UserService:
         If role_id is provided it links the UserTenant to a custom Role record.
         The ``role`` string is the built-in role (admin/editor/viewer).
         """
+
+        # ── Hook: user.before_create (Action) ──
+        from app.core.hooks import do_action
+        await do_action("user.before_create", email=email, name=name, role=role, tenant_id=tenant_id)
+
         user = User(
             email=email,
             name=name,
@@ -125,6 +130,10 @@ class UserService:
         db.add(ut)
         await db.flush()
 
+        # ── Hook: user.after_create (Action) ──
+        from app.core.hooks import do_action
+        await do_action("user.after_create", user_id=str(user.id), email=email, name=name, role=role, tenant_id=tenant_id)
+
         return user
 
     async def update_user(