fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

app/plugins/builtins/ai_ui_control/routes.py

@@ -11,12 +11,10 @@ import json
 import logging
 import uuid
 
-from fastapi import APIRouter, WebSocket, WebSocketDisconnect, Depends, HTTPException, Request
-from fastapi.responses import JSONResponse
+from fastapi import APIRouter, Depends, HTTPException, Request, WebSocket, WebSocketDisconnect
 
 from app.deps import require_permission
 from app.plugins.builtins.ai_ui_control.schemas import (
-    UICommand,
     UICommandCreate,
     UICommandFeedback,
     UICommandResponse,
@@ -45,7 +43,7 @@ async def send_ui_command(
     Authentication: requires valid session (same-user commands only).
     """
     from app.config import get_settings
-    from app.core.auth import get_session_data, get_redis
+    from app.core.auth import get_redis, get_session_data
     from app.core.service_container import get_container
 
     settings = get_settings()
@@ -117,7 +115,7 @@ async def get_command_status(
     AI agents call this to check if the frontend has executed the command.
     """
     from app.config import get_settings
-    from app.core.auth import get_session_data, get_redis
+    from app.core.auth import get_redis, get_session_data
     from app.core.service_container import get_container
 
     settings = get_settings()
@@ -173,7 +171,7 @@ async def get_command_status(
 async def get_online_users(request: Request):
     """Check which users are currently online (have active frontend WS connections)."""
     from app.config import get_settings
-    from app.core.auth import get_session_data, get_redis
+    from app.core.auth import get_redis, get_session_data
     from app.core.service_container import get_container
 
     settings = get_settings()
@@ -225,9 +223,11 @@ async def ai_ui_control_ws(websocket: WebSocket):
     tenant_id = auth["tenant_id"]
 
     # Plugin-Gate: check if ai_ui_control plugin is active (global + tenant)
-    from app.core.permission_registry import get_permission_registry
-    from sqlalchemy import text as sa_text
     import uuid as _uuid
+
+    from sqlalchemy import text as sa_text
+
+    from app.core.permission_registry import get_permission_registry
     try:
         registry = get_permission_registry()
         if not registry.is_plugin_active("ai_ui_control"):