feat: Plugin-System Umbau — 6 Phasen komplett abgeschlossen

Phase 1: Contracts konsequent nutzen
- 12 neue contracts.py erstellt (alle 19 Plugins haben jetzt contracts)
- 4 bestehende contracts.py an zentrale ContractRegistry angepasst
- Alle 19 Plugins haben on_deactivate mit Contract-Unregister
- 0 echte problematische INTER-Plugin Imports

Phase 2: Hooks/Filters-System
- app/core/hooks.py (HookRegistry mit actions + filters)
- 15 Hook-Punkte in Core-Services (contact, auth, mail, calendar, user, dms)
- BasePlugin.on_deactivate meldet alle Hooks ab

Phase 3: Plugin-Isolation
- scripts/check_cross_plugin_imports.py (Linting-Regel)
- .github/workflows/check-cross-plugin-imports.yml (CI/CD)
- .pre-commit-cross-plugin.yaml (Pre-commit Hook)
- 155 Dateien geprueft, 0 Verstoesse

Phase 4: Plugin-Versioning
- app/plugins/semver.py (SemVer mit Parse, Compare, Pre-release)
- migration_runner.py erweitert: run_migration_down, rollback_to_version
- manifest.py: min_app_version Feld
- registry.py: App-Version-Compatibility-Check bei Installation
- GET /api/v1/plugins/updates Endpoint

Phase 5: Marketplace-Vorbereitung
- app/plugins/signature.py (Ed25519 Signatur-Validierung)
- app/plugins/quarantine.py (Plugin-Quarantine mit Validierung)
- app/models/plugin_allowlist.py + Migration 0046
- manifest.py: author, license, homepage, icon, screenshots, changelog, marketplace_tags, price
- registry.py: discover_external(), discover_all()
- POST /api/v1/plugins/install-marketplace (deaktiviert)

Phase 6: Manifest-Anpassung
- manifest.py: 12 neue Felder + SemVer/Hook-Name Validierung
- MANIFEST_SCHEMA_DOC aktualisiert
- Alle 19 Plugin-Manifeste aktualisiert
- Frontend PluginUiManifest Typ erweitert

Zusaetzliche Bug-Fixes:
- test_sample-Modul erstellt
- conftest.py Deadlock-Prevention
- SESSION_COOKIE_SECURE=true
- dump.rdb aus Git entfernt + .gitignore
- backup.py datetime.utcnow -> func.now()
- system_settings.py JSONB-Import nach oben
- tax.py Mapped[float] -> Mapped[Decimal]
- notification.py type_key-Laengen vereinheitlicht

Tests: 91 neue Tests, alle bestanden

tests/test_manifest_validation.py

@@ -0,0 +1,101 @@
+"""Tests for PluginManifest validation: SemVer, hook names, marketplace fields."""
+
+from __future__ import annotations
+
+import pytest
+
+from app.plugins.manifest import PluginManifest
+
+
+class TestManifestValidation:
+    def test_valid_min_app_version(self):
+        """Valid SemVer min_app_version is accepted."""
+        m = PluginManifest(
+            name="test", version="1.0.0", display_name="Test",
+            min_app_version="1.2.3",
+        )
+        assert m.min_app_version == "1.2.3"
+
+    def test_default_min_app_version(self):
+        """Default min_app_version is 0.0.0."""
+        m = PluginManifest(name="test", version="1.0.0", display_name="Test")
+        assert m.min_app_version == "0.0.0"
+
+    def test_invalid_min_app_version(self):
+        """Invalid SemVer min_app_version is rejected."""
+        with pytest.raises(Exception):
+            PluginManifest(
+                name="test", version="1.0.0", display_name="Test",
+                min_app_version="not-a-version",
+            )
+
+    def test_valid_hooks(self):
+        """Valid hook names are accepted."""
+        m = PluginManifest(
+            name="test", version="1.0.0", display_name="Test",
+            hooks=["contact.before_create", "mail.after_send"],
+        )
+        assert len(m.hooks) == 2
+
+    def test_invalid_hook_name(self):
+        """Invalid hook name format is rejected."""
+        with pytest.raises(Exception):
+            PluginManifest(
+                name="test", version="1.0.0", display_name="Test",
+                hooks=["InvalidHookName"],
+            )
+
+    def test_invalid_hook_no_dot(self):
+        """Hook name without dot is rejected."""
+        with pytest.raises(Exception):
+            PluginManifest(
+                name="test", version="1.0.0", display_name="Test",
+                hooks=["contact"],
+            )
+
+    def test_empty_hooks_allowed(self):
+        """Empty hooks list is allowed."""
+        m = PluginManifest(
+            name="test", version="1.0.0", display_name="Test",
+            hooks=[],
+        )
+        assert m.hooks == []
+
+    def test_marketplace_fields_defaults(self):
+        """All marketplace fields have correct defaults."""
+        m = PluginManifest(name="test", version="1.0.0", display_name="Test")
+        assert m.author == ""
+        assert m.author_email == ""
+        assert m.homepage == ""
+        assert m.license == "MIT"
+        assert m.icon == ""
+        assert m.screenshots == []
+        assert m.changelog == ""
+        assert m.marketplace_tags == []
+        assert m.price == 0.0
+        assert m.contract_version == "1.0.0"
+
+    def test_marketplace_fields_set(self):
+        """Marketplace fields can be set."""
+        m = PluginManifest(
+            name="test", version="1.0.0", display_name="Test",
+            author="Jane Doe",
+            author_email="jane@example.com",
+            homepage="https://example.com/plugin",
+            license="Apache-2.0",
+            icon="📦",
+            screenshots=["https://example.com/s1.png"],
+            changelog="https://example.com/changelog.md",
+            marketplace_tags=["crm", "ai"],
+            price=9.99,
+            contract_version="2.0.0",
+        )
+        assert m.author == "Jane Doe"
+        assert m.license == "Apache-2.0"
+        assert m.price == 9.99
+        assert m.contract_version == "2.0.0"
+
+    def test_name_validation_lowercase(self):
+        """Plugin name is lowercased."""
+        m = PluginManifest(name="MyPlugin", version="1.0.0", display_name="Test")
+        assert m.name == "myplugin"