fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

app/plugins/builtins/dms/routes.py

@@ -21,7 +21,7 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
-from app.core.storage import get_storage_backend, LocalStorage
+from app.core.storage import LocalStorage, get_storage_backend
 from app.core.visibility import apply_visibility_filter, check_single_entity_access
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.dms.models import File as DmsFile
@@ -140,7 +140,7 @@ def _is_blocked_filetype(filename: str) -> bool:
     return ext in BLOCKED_EXTENSIONS
 
 
-CHUNK_SIZE = 1024 * 1024  # 1MB chunks for streaming uploads
+chunk_size = 1024 * 1024  # 1MB chunks for streaming uploads
 
 # ─── Folders ───
 
@@ -546,14 +546,14 @@ async def upload_file(
 
     # Stream file to storage — avoid loading entire file into RAM
     import hashlib
-    CHUNK_SIZE = 1024 * 1024  # 1MB chunks
+    chunk_size = 1024 * 1024  # 1MB chunks
     sha256 = hashlib.sha256()
     file_size = 0
 
     async def chunk_stream():
         nonlocal file_size
         while True:
-            chunk = await file.read(CHUNK_SIZE)
+            chunk = await file.read(chunk_size)
             if not chunk:
                 break
             file_size += len(chunk)
@@ -1011,8 +1011,8 @@ async def preview_file(
         )
 
     # Stream file directly from storage without loading into RAM
+
     from fastapi.responses import FileResponse as FastApiFileResponse
-    import os as _os
 
     if isinstance(storage, LocalStorage):
         # LocalStorage: use FileResponse for automatic streaming