feat(D): Phase D — Undo/Restore komplett implementiert

- D-GEN: RestoreRegistry mit RestoreConfig (model_class, restore_permission, excluded_fields, special_handler)
- D-HOOK: history_hooks.py mit register_history_hooks() für after_create/update/delete
- D-CORE: Company create+update record_history in companies.py
- D-PLUG: Task/Calendar/DMS record_history in services/routes
- D-SOFT: Alle registrierten Entitäten haben deleted_at + un-delete via Registry
- D-MAIL: Mail special_handler (IMAP Trash-Move, Folder-Verify) + record_history in delete/move
- D-TRASH: GET /entity-history/trash (filterbar, paginiert) + Frontend Trash.tsx
- D-TOAST: UndoToast.tsx (5s Auto-Dismiss, useUndoToast Hook)
- D-HIST-UI: HistoryPanel.tsx (Timeline, Diff-View, Restore-Button)
- D-BULK: POST /entity-history/bulk-restore mit partial_success Semantik
- D-RET: POST /entity-history/retention/archive (GDPR hard-delete >90 Tage)
- D-TEST: 26 Tests in test_restore_registry.py, alle grün
- D-DOC: test-strategy.md + security_kernel.md aktualisiert

Backend: 10 Dateien, Frontend: 7 Dateien, Tests: 1 Datei, Docs: 3 Dateien
26/26 Tests passed, TSC 0 errors, App import 492 routes

PROGRESS.md

@@ -13,7 +13,7 @@
 | B — System-Konsolidierung | `done` | 2026-08-13 | 2026-08-13 | ~50 | ~50 |
 | C — Core UI | `done` | 2026-08-13 | 2026-08-13 | 14 | 14 |
 | C.5 — Import/Export | `done` | 2026-08-13 | 2026-08-13 | 8 | 8 |
-| D — Undo/Restore | `not_started` | — | — | 0 | ~12 |
+| D — Undo/Restore | `done` | 2026-08-13 | 2026-08-13 | 13 | 13 |
 | E — Search | `not_started` | — | — | 0 | ~24 |
 | F — Agents | `not_started` | — | — | 0 | ~28 |
 | G — Workflows | `not_started` | — | — | 0 | ~24 |
@@ -212,7 +212,27 @@
 
 ---
 
-## Phasen D-J
+## Phase D — Undo/Restore
+
+| Task | Status | Forgejo Issue | Verifiziert |
+|------|-------|---------------|------------|
+| D-GEN | `done` | — | ✅ RestoreRegistry Singleton, RestoreConfig (model_class, restore_permission, excluded_fields, special_handler), register_default_entities() mit 5 Entity-Typen |
+| D-HOOK | `done` | — | ✅ history_hooks.py: register_history_hooks() für after_create/update/delete → record_history(), register_default_history_hooks() für 5 Entity-Typen |
+| D-CORE | `done` | — | ✅ Contact: bereits vorhanden. Company: record_history für create+update+delete in companies.py hinzugefügt |
+| D-PLUG | `done` | — | ✅ Task: create/update/delete in services.py. Calendar Entry: create/update/delete in routes.py. DMS File: upload/update/delete in routes.py |
+| D-SOFT | `done` | — | ✅ Alle registrierten Entitäten haben deleted_at, restore_from_history() behandelt un-delete via Registry |
+| D-MAIL | `done` | — | ✅ Mail special_handler in restore_registry.py (IMAP Trash-Move, Folder-Verify, kein falscher Status). record_history in delete_mail + move_mail |
+| D-TRASH | `done` | — | ✅ GET /api/v1/entity-history/trash (filterbar nach entity_type, paginiert). Frontend Trash.tsx mit Multi-Select |
+| D-TOAST | `done` | — | ✅ UndoToast.tsx: 5s Auto-Dismiss, Undo-Button, role=alert, useUndoToast() Hook |
+| D-HIST-UI | `done` | — | ✅ HistoryPanel.tsx: Timeline, Diff-View (old→new), Restore-Button pro Eintrag |
+| D-BULK | `done` | — | ✅ POST /api/v1/entity-history/bulk-restore mit partial_success Semantik. Frontend Bulk-Restore in Trash.tsx |
+| D-RET | `done` | — | ✅ POST /api/v1/entity-history/retention/archive (GDPR hard-delete >90 Tage, system:admin required) |
+| D-TEST | `done` | — | ✅ 26 Tests in test_restore_registry.py, alle grün. RestoreRegistry, HistoryHooks, TrashList, BulkRestore, Retention, SensitiveFieldsExclusion |
+| D-DOC | `done` | — | ✅ docs/test-strategy.md + docs/security_kernel.md aktualisiert mit Phase D Abschnitten |
+
+---
+
+## Phasen E-J
 
 Detaillierte Task-Listen werden beim Start der jeweiligen Phase eingetragen. Siehe `PLATFORM_ROADMAP.md` für alle Tasks.