feat(D): Phase D — Undo/Restore komplett implementiert

- D-GEN: RestoreRegistry mit RestoreConfig (model_class, restore_permission, excluded_fields, special_handler)
- D-HOOK: history_hooks.py mit register_history_hooks() für after_create/update/delete
- D-CORE: Company create+update record_history in companies.py
- D-PLUG: Task/Calendar/DMS record_history in services/routes
- D-SOFT: Alle registrierten Entitäten haben deleted_at + un-delete via Registry
- D-MAIL: Mail special_handler (IMAP Trash-Move, Folder-Verify) + record_history in delete/move
- D-TRASH: GET /entity-history/trash (filterbar, paginiert) + Frontend Trash.tsx
- D-TOAST: UndoToast.tsx (5s Auto-Dismiss, useUndoToast Hook)
- D-HIST-UI: HistoryPanel.tsx (Timeline, Diff-View, Restore-Button)
- D-BULK: POST /entity-history/bulk-restore mit partial_success Semantik
- D-RET: POST /entity-history/retention/archive (GDPR hard-delete >90 Tage)
- D-TEST: 26 Tests in test_restore_registry.py, alle grün
- D-DOC: test-strategy.md + security_kernel.md aktualisiert

Backend: 10 Dateien, Frontend: 7 Dateien, Tests: 1 Datei, Docs: 3 Dateien
26/26 Tests passed, TSC 0 errors, App import 492 routes

app/routes/companies.py

@@ -117,9 +117,12 @@ async def create_company(
     )
     db.add(audit_entry)
     await db.flush()
+    # Record history (D-CORE)
+    snapshot = _serialize_company(company)
+    await record_history(db, tenant_id, user_id, "contact", company.id, "create", snapshot_after=snapshot)
     from app.core.hooks import do_action
-    await do_action("company.after_create", _serialize_company(company), db=db, tenant_id=tenant_id, user_id=user_id)
-    return _serialize_company(company)
+    await do_action("company.after_create", snapshot, db=db, tenant_id=tenant_id, user_id=user_id)
+    return snapshot
 
 
 @router.get("/export")
@@ -208,6 +211,8 @@ async def update_company(
         raise HTTPException(status_code=404, detail="Company not found")
     from app.core.hooks import do_action
     await do_action("company.before_update", body, db=db, tenant_id=tenant_id, user_id=user_id, company_id=company_id)
+    # Capture snapshot before update (D-CORE)
+    snapshot_before = _serialize_company(company)
     if "name" in body:
         company.name = body["name"]
         company.displayname = body["name"]
@@ -222,13 +227,25 @@ async def update_company(
     company.custom = custom
     company.updated_by = user_id
     await db.flush()
+    snapshot_after = _serialize_company(company)
+    # Compute changes diff (D-CORE)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-CORE)
+    await record_history(
+        db, tenant_id, user_id, "contact", company.id, "update",
+        snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None,
+    )
     audit_entry = AuditLog(tenant_id=tenant_id, user_id=user_id, action="update",
                           entity_type="contact", entity_id=company.id, changes=body)
     db.add(audit_entry)
     await db.flush()
     from app.core.hooks import do_action
-    await do_action("company.after_update", _serialize_company(company), db=db, tenant_id=tenant_id, user_id=user_id, company_id=company_id)
-    return _serialize_company(company)
+    await do_action("company.after_update", snapshot_after, db=db, tenant_id=tenant_id, user_id=user_id, company_id=company_id)
+    return snapshot_after
 
 
 @router.delete("/{company_id}", status_code=status.HTTP_204_NO_CONTENT)