chore: Clean up dump.rdb, templates/, test_report.md; update .a0 status files

.a0/current_status.md

@@ -1,47 +1,31 @@
 # LeoCRM — Current Status
-**Phase**: Fix Branch — 20/22 FIX-PLAN Items erledigt
-**Last update**: 2026-07-26 16:25
-**Branch**: main (leocrm-fix)
+**Last update**: 2026-08-04
+**Branch**: main
+**Git HEAD**: 157e454
+**Alembic-Head**: 0103
+**Produktion**: https://crm.media-on.de — healthy
 
-## FIX-PLAN Überprüfung (2026-07-26)
-Alle 22 Items gegen Codebasis verifiziert. 20 erledigt, 2 offen.
+## Security Fix Plan — Alle Phasen abgeschlossen
+| Phase | Status |
+|-------|--------|
+| 1 — Kritische Sicherheitslücken | ✅ |
+| 2 — Visibility Filter & Owner ID | ✅ |
+| 3 — WebSocket CSRF, SameSite, FK CASCADE | ✅ |
+| 4 — Krisensicherheit (Circuit Breaker, Retry, Fallback) | ✅ |
+| 5 — Architektur-Lücken (9 Sub-Tasks) | ✅ |
 
-### Erledigt (20)
-- P0-1: Auth-Bypass entfernt ✅
-- P0-2: Migrationen repariert ✅
-- P0-3: Plugin-Upload deaktiviert ✅
-- P0-4: RLS FORCE + WITH CHECK ✅
-- P0-5: Plugin-Doppelregistrierung behoben ✅
-- P0-6: Persistent Volume ✅
-- P1-1: User/Tenant-Modell bereinigt ✅
-- P1-2: Redis zentralisiert ✅
-- P1-3: Worker ausgelagert ✅
-- P1-4: Transactional Outbox ✅
-- P1-5: XSS-Stellen geschlossen ✅
-- P1-6: DMS lastfest ✅
-- P1-7: Permission-System vereinheitlicht ✅
-- P1-8: Password Reset funktionsfähig ✅
-- P1-9: Metrics abgesichert ✅
-- P1-10: Coolify-Doku & Config korrigiert ✅
-- P1-11: Cross-Tenant FK ✅
-- P2-1: Contact Model normalisiert ✅
-- P2-3: Commands & Statusmaschinen ✅
-- P2-4: SPA Path-Traversal ✅
+## Implementierte Features (Phase 5)
+- PWA (VitePWA, manifest.json, service worker)
+- Public Plugin Endpoints (is_public, share-link routes)
+- Contacts Embedding (Vector(768), HNSW index)
+- 10 Search Providers (contact, company, mail, file, event, task, contactperson, tag, conversation, user)
+- Plugin-Marketplace (listing, download, Ed25519 verify, install)
+- Agent Memory (persistent, pgvector semantic search)
+- GraphRAG (entity relationships, BFS traversal, search provider)
+- Subagents/Multi-Agent (AgentCoordinator, subtask management)
+- External Agent API (Bearer token, SSE streaming, rate limiting)
+- Circuit Breaker + DB Retry + Redis Graceful Degradation
 
-### Offen (2)
-- P0-7: App von öffentlicher Domain nehmen (operational — 30 Min)
-- P2-2: Plugin-Cross-Imports reduzieren (228 Imports — 1-2 Wochen)
-
-## Previous: P1-4: Transactional Outbox — COMPLETE
-- Migration 0040_outbox.py created (down_revision=0039_contact_normalize)
-- event_outbox table: id, tenant_id, event_name, payload JSONB, status, attempts, max_attempts, next_retry_at, timestamps
-- app/core/outbox.py: enqueue_outbox_event() + process_outbox_batch() with FOR UPDATE SKIP LOCKED, exponential backoff retry
-- app/core/event_bus.py: added publish_with_results() for error-aware publishing; docstring note about outbox
-- app/core/worker.py: process_outbox_job cron (every 5s, Redis distributed lock)
-- app/services/contact_service.py: contact.created, lead.created, contact.updated → enqueue_outbox_event
-- app/models/outbox.py: SQLAlchemy ORM model for event_outbox
-- tests/test_outbox.py: 6 tests, all passing
-- py_compile: OK, alembic heads: single head 0040_outbox
-
-## Previous: P2-1: Unified Contact Model normalisieren — COMPLETE
-- Migration 0039_contact_normalize.py (down_revision=0038_dms_content_hash)
+## Offene Items
+- IMPLEMENTATION_PLAN.md: 14 Frontend-Features in 4 Phasen (nicht begonnen)
+- Test-Instanzen CRM2/CRM3 noch aktiv (können gelöscht werden)