feat(D): Phase D — Undo/Restore komplett implementiert

- D-GEN: RestoreRegistry mit RestoreConfig (model_class, restore_permission, excluded_fields, special_handler)
- D-HOOK: history_hooks.py mit register_history_hooks() für after_create/update/delete
- D-CORE: Company create+update record_history in companies.py
- D-PLUG: Task/Calendar/DMS record_history in services/routes
- D-SOFT: Alle registrierten Entitäten haben deleted_at + un-delete via Registry
- D-MAIL: Mail special_handler (IMAP Trash-Move, Folder-Verify) + record_history in delete/move
- D-TRASH: GET /entity-history/trash (filterbar, paginiert) + Frontend Trash.tsx
- D-TOAST: UndoToast.tsx (5s Auto-Dismiss, useUndoToast Hook)
- D-HIST-UI: HistoryPanel.tsx (Timeline, Diff-View, Restore-Button)
- D-BULK: POST /entity-history/bulk-restore mit partial_success Semantik
- D-RET: POST /entity-history/retention/archive (GDPR hard-delete >90 Tage)
- D-TEST: 26 Tests in test_restore_registry.py, alle grün
- D-DOC: test-strategy.md + security_kernel.md aktualisiert

Backend: 10 Dateien, Frontend: 7 Dateien, Tests: 1 Datei, Docs: 3 Dateien
26/26 Tests passed, TSC 0 errors, App import 492 routes

app/plugins/builtins/dms/routes.py

@@ -612,6 +612,13 @@ async def upload_file(
         )
         db.add(dms_file)
         await db.flush()
+        # Record history for new file only (D-PLUG)
+        from app.services.entity_history_service import record_history
+        await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "create", snapshot_after={
+            "id": str(dms_file.id), "name": dms_file.name,
+            "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+            "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+        })
 
     # Lifecycle hook: dms.after_upload
     from app.core.hooks import do_action
@@ -793,6 +800,13 @@ async def update_file(
 
     data = body.model_dump(exclude_unset=True)
 
+    # Capture snapshot before update (D-PLUG)
+    snapshot_before = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+
     if "name" in data and data["name"] is not None:
         dms_file.name = data["name"]
 
@@ -813,6 +827,22 @@ async def update_file(
     await db.flush()
     await db.refresh(dms_file)
 
+    snapshot_after = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+    # Compute changes diff (D-PLUG)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "update",
+                         snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None)
+
     # Lifecycle hook: dms.after_update
     from app.core.hooks import do_action
     await do_action("dms.after_update", {'id': str(dms_file.id), 'name': dms_file.name}, db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)
@@ -860,11 +890,22 @@ async def delete_file(
     from app.core.hooks import do_action
     await do_action("dms.before_delete", db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)
 
+    # Capture snapshot before delete (D-PLUG)
+    snapshot_before = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+
     from datetime import UTC, datetime
 
     dms_file.deleted_at = datetime.now(UTC)
     await db.flush()
 
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "delete", snapshot_before=snapshot_before)
+
     # Lifecycle hook: dms.after_delete
     await do_action("dms.after_delete", db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)