fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

app/plugins/builtins/automation/agent_routes.py

@@ -7,13 +7,13 @@ from __future__ import annotations
 
 import logging
 import uuid
+from datetime import UTC
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.db import get_db, set_tenant_context
-from app.core.visibility import apply_visibility_filter
+from app.core.db import get_db
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.automation.models import (
     AgentDefinition,
@@ -216,7 +216,7 @@ async def get_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     agent = await AgentService.get_by_id(db, tenant_id, aid)
     if agent is None:
@@ -241,7 +241,7 @@ async def update_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     agent = await AgentService.update(
         db, tenant_id, aid, data.model_dump(exclude_none=True), user_id=user_id
@@ -265,7 +265,7 @@ async def delete_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     success = await AgentService.delete(db, tenant_id, aid)
     if not success:
@@ -290,7 +290,7 @@ async def execute_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     agent = await AgentService.get_by_id(db, tenant_id, aid)
     if agent is None:
@@ -325,9 +325,10 @@ async def execute_agent(
     )
 
     # Update run with results
+    from datetime import datetime
+
     from sqlalchemy import update as sa_update
-    from datetime import datetime, timezone
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     async with db.begin():
         await db.execute(
             sa_update(AgentRun)
@@ -358,7 +359,7 @@ async def test_run_agent(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     agent = await AgentService.get_by_id(db, tenant_id, aid)
     if agent is None:
@@ -397,7 +398,7 @@ async def list_agent_runs(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     items, total = await RunLogService.list_agent_runs(
         db, tenant_id, agent_id=aid, status=status, limit=limit, offset=offset
@@ -428,7 +429,7 @@ async def list_agent_versions(
     try:
         aid = uuid.UUID(agent_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     items, total = await AgentService.get_versions(
         db, tenant_id, aid, limit=limit, offset=offset
@@ -457,7 +458,7 @@ async def restore_agent_version(
         aid = uuid.UUID(agent_id)
         vid = uuid.UUID(version_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid ID")
+        raise HTTPException(status_code=400, detail="Invalid ID") from None
 
     agent = await AgentService.restore_version(
         db, tenant_id, aid, vid, user_id=user_id
@@ -485,7 +486,7 @@ async def send_agent_message_endpoint(
     try:
         aid = uuid.UUID(id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid agent ID")
+        raise HTTPException(status_code=400, detail="Invalid agent ID") from None
 
     # Verify the source agent exists
     agent = await AgentService.get_by_id(db, tenant_id, aid)