feat(D): Phase D — Undo/Restore komplett implementiert

- D-GEN: RestoreRegistry mit RestoreConfig (model_class, restore_permission, excluded_fields, special_handler)
- D-HOOK: history_hooks.py mit register_history_hooks() für after_create/update/delete
- D-CORE: Company create+update record_history in companies.py
- D-PLUG: Task/Calendar/DMS record_history in services/routes
- D-SOFT: Alle registrierten Entitäten haben deleted_at + un-delete via Registry
- D-MAIL: Mail special_handler (IMAP Trash-Move, Folder-Verify) + record_history in delete/move
- D-TRASH: GET /entity-history/trash (filterbar, paginiert) + Frontend Trash.tsx
- D-TOAST: UndoToast.tsx (5s Auto-Dismiss, useUndoToast Hook)
- D-HIST-UI: HistoryPanel.tsx (Timeline, Diff-View, Restore-Button)
- D-BULK: POST /entity-history/bulk-restore mit partial_success Semantik
- D-RET: POST /entity-history/retention/archive (GDPR hard-delete >90 Tage)
- D-TEST: 26 Tests in test_restore_registry.py, alle grün
- D-DOC: test-strategy.md + security_kernel.md aktualisiert

Backend: 10 Dateien, Frontend: 7 Dateien, Tests: 1 Datei, Docs: 3 Dateien
26/26 Tests passed, TSC 0 errors, App import 492 routes

app/plugins/builtins/calendar/routes.py

@@ -465,6 +465,9 @@ async def create_entry(
     )
     db.add(entry)
     await db.flush()
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "calendar_entry", entry.id, "create", snapshot_after=_entry_to_dict(entry))
 
     # ── Hook: calendar.after_appointment (Action) ──
     from app.core.hooks import do_action
@@ -614,6 +617,8 @@ async def update_entry(
 
     from app.core.hooks import do_action
     await do_action("calendar.before_update", body=body, tenant_id=tenant_id, user_id=user_id, entry_id=entry_id)
+    # Capture snapshot before update (D-PLUG)
+    snapshot_before = _entry_to_dict(entry)
     # Apply updates
     if body.title is not None:
         entry.title = body.title
@@ -648,9 +653,20 @@ async def update_entry(
 
     await db.flush()
     await db.refresh(entry)
+    snapshot_after = _entry_to_dict(entry)
+    # Compute changes diff (D-PLUG)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "calendar_entry", entry.id, "update",
+                         snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None)
     from app.core.hooks import do_action
     await do_action("calendar.after_update", entry_id=str(entry.id), tenant_id=tenant_id, user_id=user_id)
-    return _entry_to_dict(entry)
+    return snapshot_after
 
 
 @router.delete("/calendar/entries/{entry_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_permission("calendar:delete"))])
@@ -670,8 +686,13 @@ async def delete_entry(
         raise HTTPException(403, detail={"detail": "No write permission", "code": "forbidden"})
     from app.core.hooks import do_action
     await do_action("calendar.before_delete", tenant_id=tenant_id, user_id=user_id, entry_id=entry_id)
+    # Capture snapshot before delete (D-PLUG)
+    snapshot_before = _entry_to_dict(entry)
     entry.deleted_at = datetime.now(UTC)
     await db.flush()
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "calendar_entry", entry.id, "delete", snapshot_before=snapshot_before)
     from app.core.hooks import do_action
     await do_action("calendar.after_delete", tenant_id=tenant_id, user_id=user_id, entry_id=entry_id)
     return Response(status_code=204)

app/plugins/builtins/dms/routes.py

@@ -612,6 +612,13 @@ async def upload_file(
         )
         db.add(dms_file)
         await db.flush()
+        # Record history for new file only (D-PLUG)
+        from app.services.entity_history_service import record_history
+        await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "create", snapshot_after={
+            "id": str(dms_file.id), "name": dms_file.name,
+            "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+            "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+        })
 
     # Lifecycle hook: dms.after_upload
     from app.core.hooks import do_action
@@ -793,6 +800,13 @@ async def update_file(
 
     data = body.model_dump(exclude_unset=True)
 
+    # Capture snapshot before update (D-PLUG)
+    snapshot_before = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+
     if "name" in data and data["name"] is not None:
         dms_file.name = data["name"]
 
@@ -813,6 +827,22 @@ async def update_file(
     await db.flush()
     await db.refresh(dms_file)
 
+    snapshot_after = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+    # Compute changes diff (D-PLUG)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "update",
+                         snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None)
+
     # Lifecycle hook: dms.after_update
     from app.core.hooks import do_action
     await do_action("dms.after_update", {'id': str(dms_file.id), 'name': dms_file.name}, db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)
@@ -860,11 +890,22 @@ async def delete_file(
     from app.core.hooks import do_action
     await do_action("dms.before_delete", db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)
 
+    # Capture snapshot before delete (D-PLUG)
+    snapshot_before = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+
     from datetime import UTC, datetime
 
     dms_file.deleted_at = datetime.now(UTC)
     await db.flush()
 
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "delete", snapshot_before=snapshot_before)
+
     # Lifecycle hook: dms.after_delete
     await do_action("dms.after_delete", db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)
 

app/plugins/builtins/mail/routes.py

@@ -1643,6 +1643,18 @@ async def delete_mail(
     account = await _get_account(db, mail.account_id, tenant_id, user_id, is_system_admin=is_system_admin)
     await _check_delegate_access(db, account, user_id, "delete")
 
+    # Capture snapshot before delete for history/restore (D-MAIL)
+    from app.services.entity_history_service import record_history
+    mail_snapshot = {
+        "id": str(mail.id),
+        "folder_id": str(mail.folder_id) if mail.folder_id else None,
+        "subject": mail.subject if hasattr(mail, "subject") else None,
+        "account_id": str(mail.account_id),
+        "is_read": mail.is_read if hasattr(mail, "is_read") else None,
+        "is_flagged": mail.is_flagged if hasattr(mail, "is_flagged") else None,
+    }
+    await record_history(db, tenant_id, user_id, "mail", mail.id, "delete", snapshot_before=mail_snapshot)
+
     # Find the Trash folder for this account
     trash_folder = None
     all_folders = (
@@ -1757,9 +1769,22 @@ async def move_mail(
     ).scalar_one_or_none()
     if not target_folder:
         raise HTTPException(404, detail={"detail": "Target folder not found", "code": "not_found"})
+    # Capture snapshot before move (D-MAIL)
+    from app.services.entity_history_service import record_history
+    snapshot_before = {
+        "id": str(mail.id),
+        "folder_id": str(mail.folder_id) if mail.folder_id else None,
+        "subject": mail.subject if hasattr(mail, "subject") else None,
+        "is_read": mail.is_read if hasattr(mail, "is_read") else None,
+        "is_flagged": mail.is_flagged if hasattr(mail, "is_flagged") else None,
+    }
     # Update mail.folder_id
     mail.folder_id = target_f_id
     await db.flush()
+    snapshot_after = {**snapshot_before, "folder_id": str(target_f_id)}
+    changes = {"folder_id": {"old": snapshot_before.get("folder_id"), "new": str(target_f_id)}}
+    await record_history(db, tenant_id, user_id, "mail", mail.id, "update",
+                         snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes)
     # IMAP move: queue for retry if it fails
     try:
         await mail_services.imap_move_mail(db, m_id, target_f_id, tenant_id)

app/plugins/builtins/tasks/services.py

@@ -117,9 +117,14 @@ async def create_task(
     )
     db.add(task)
     await db.flush()
+    snapshot = _task_to_dict(task)
+
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "task", task.id, "create", snapshot_after=snapshot)
 
     from app.core.hooks import do_action
-    await do_action("task.after_create", _task_to_dict(task), db=db, tenant_id=tenant_id, user_id=user_id)
+    await do_action("task.after_create", snapshot, db=db, tenant_id=tenant_id, user_id=user_id)
 
     # Publish task.created event
     from app.core.event_bus import get_event_bus
@@ -151,6 +156,8 @@ async def update_task(
 
     from app.core.hooks import do_action
     await do_action("task.before_update", data, db=db, tenant_id=tenant_id, task_id=str(task_id))
+    # Capture snapshot before update (D-PLUG)
+    snapshot_before = _task_to_dict(task)
     if "title" in data and data["title"] is not None:
         task.title = data["title"]
     if "description" in data:
@@ -168,9 +175,20 @@ async def update_task(
 
     await db.flush()
     await db.refresh(task)
+    snapshot_after = _task_to_dict(task)
+    # Compute changes diff (D-PLUG)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history as _rh
+    await _rh(db, tenant_id, None, "task", task.id, "update",
+              snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None)
     from app.core.hooks import do_action
-    await do_action("task.after_update", _task_to_dict(task), db=db, tenant_id=tenant_id, task_id=str(task_id))
-    return _task_to_dict(task)
+    await do_action("task.after_update", snapshot_after, db=db, tenant_id=tenant_id, task_id=str(task_id))
+    return snapshot_after
 
 
 async def delete_task(db: AsyncSession, tenant_id: uuid.UUID, task_id: uuid.UUID) -> bool:
@@ -183,8 +201,13 @@ async def delete_task(db: AsyncSession, tenant_id: uuid.UUID, task_id: uuid.UUID
         return False
     from app.core.hooks import do_action
     await do_action("task.before_delete", db=db, tenant_id=tenant_id, task_id=str(task_id))
+    # Capture snapshot before delete (D-PLUG)
+    snapshot_before = _task_to_dict(task)
     task.deleted_at = datetime.now(timezone.utc)
     await db.flush()
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history as _rh
+    await _rh(db, tenant_id, None, "task", task.id, "delete", snapshot_before=snapshot_before)
     from app.core.hooks import do_action
     await do_action("task.after_delete", db=db, tenant_id=tenant_id, task_id=str(task_id))
     return True