feat(D): Phase D — Undo/Restore komplett implementiert

- D-GEN: RestoreRegistry mit RestoreConfig (model_class, restore_permission, excluded_fields, special_handler)
- D-HOOK: history_hooks.py mit register_history_hooks() für after_create/update/delete
- D-CORE: Company create+update record_history in companies.py
- D-PLUG: Task/Calendar/DMS record_history in services/routes
- D-SOFT: Alle registrierten Entitäten haben deleted_at + un-delete via Registry
- D-MAIL: Mail special_handler (IMAP Trash-Move, Folder-Verify) + record_history in delete/move
- D-TRASH: GET /entity-history/trash (filterbar, paginiert) + Frontend Trash.tsx
- D-TOAST: UndoToast.tsx (5s Auto-Dismiss, useUndoToast Hook)
- D-HIST-UI: HistoryPanel.tsx (Timeline, Diff-View, Restore-Button)
- D-BULK: POST /entity-history/bulk-restore mit partial_success Semantik
- D-RET: POST /entity-history/retention/archive (GDPR hard-delete >90 Tage)
- D-TEST: 26 Tests in test_restore_registry.py, alle grün
- D-DOC: test-strategy.md + security_kernel.md aktualisiert

Backend: 10 Dateien, Frontend: 7 Dateien, Tests: 1 Datei, Docs: 3 Dateien
26/26 Tests passed, TSC 0 errors, App import 492 routes

app/plugins/builtins/tasks/services.py

@@ -117,9 +117,14 @@ async def create_task(
     )
     db.add(task)
     await db.flush()
+    snapshot = _task_to_dict(task)
+
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "task", task.id, "create", snapshot_after=snapshot)
 
     from app.core.hooks import do_action
-    await do_action("task.after_create", _task_to_dict(task), db=db, tenant_id=tenant_id, user_id=user_id)
+    await do_action("task.after_create", snapshot, db=db, tenant_id=tenant_id, user_id=user_id)
 
     # Publish task.created event
     from app.core.event_bus import get_event_bus
@@ -151,6 +156,8 @@ async def update_task(
 
     from app.core.hooks import do_action
     await do_action("task.before_update", data, db=db, tenant_id=tenant_id, task_id=str(task_id))
+    # Capture snapshot before update (D-PLUG)
+    snapshot_before = _task_to_dict(task)
     if "title" in data and data["title"] is not None:
         task.title = data["title"]
     if "description" in data:
@@ -168,9 +175,20 @@ async def update_task(
 
     await db.flush()
     await db.refresh(task)
+    snapshot_after = _task_to_dict(task)
+    # Compute changes diff (D-PLUG)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history as _rh
+    await _rh(db, tenant_id, None, "task", task.id, "update",
+              snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None)
     from app.core.hooks import do_action
-    await do_action("task.after_update", _task_to_dict(task), db=db, tenant_id=tenant_id, task_id=str(task_id))
-    return _task_to_dict(task)
+    await do_action("task.after_update", snapshot_after, db=db, tenant_id=tenant_id, task_id=str(task_id))
+    return snapshot_after
 
 
 async def delete_task(db: AsyncSession, tenant_id: uuid.UUID, task_id: uuid.UUID) -> bool:
@@ -183,8 +201,13 @@ async def delete_task(db: AsyncSession, tenant_id: uuid.UUID, task_id: uuid.UUID
         return False
     from app.core.hooks import do_action
     await do_action("task.before_delete", db=db, tenant_id=tenant_id, task_id=str(task_id))
+    # Capture snapshot before delete (D-PLUG)
+    snapshot_before = _task_to_dict(task)
     task.deleted_at = datetime.now(timezone.utc)
     await db.flush()
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history as _rh
+    await _rh(db, tenant_id, None, "task", task.id, "delete", snapshot_before=snapshot_before)
     from app.core.hooks import do_action
     await do_action("task.after_delete", db=db, tenant_id=tenant_id, task_id=str(task_id))
     return True