fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

app/routes/contacts.py

@@ -10,29 +10,27 @@ import io
 import uuid
 from typing import Any
 
+import redis.asyncio as aioredis
 from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
 from fastapi.responses import StreamingResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-import redis.asyncio as aioredis
-
 from app.commands.contact_commands import (
     CreateContactCommand,
-    UpdateContactCommand,
     DeleteContactCommand,
     MergeContactsCommand,
+    UpdateContactCommand,
 )
 from app.core.db import get_db
 from app.core.visibility import check_single_entity_access
-from app.deps import get_current_user, get_redis_dep, require_permission
+from app.deps import get_redis_dep, require_permission
 from app.schemas.contact import (
     ContactCreate,
-    ContactUpdate,
     ContactPersonCreate,
     ContactPersonUpdate,
+    ContactUpdate,
 )
-from app.services import contact_service
-from app.services import dedup_service
+from app.services import contact_service, dedup_service
 from app.services.export_service import export_service
 
 router = APIRouter(prefix="/api/v1/contacts", tags=["contacts"])
@@ -40,7 +38,7 @@ router = APIRouter(prefix="/api/v1/contacts", tags=["contacts"])
 
 # ── Deduplication / Merge (Task 5.23) ──────────────────────────────────────────
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field  # noqa: E402
 
 
 class DuplicateCheckRequest(BaseModel):
@@ -153,9 +151,9 @@ async def get_contact(
     try:
         return await contact_service.get_contact(db, tenant_id, contact_id, user_id=user_id, is_system_admin=is_admin)
     except ValueError as e:
-        raise HTTPException(status_code=404, detail=str(e))
+        raise HTTPException(status_code=404, detail=str(e)) from e
     except PermissionError as e:
-        raise HTTPException(status_code=403, detail=str(e))
+        raise HTTPException(status_code=403, detail=str(e)) from e
 
 
 @router.put("/{contact_id}")
@@ -223,7 +221,7 @@ async def create_contact_person(
     try:
         return await contact_service.create_contact_person(db, tenant_id, user_id, contact_id, data)
     except ValueError as e:
-        raise HTTPException(status_code=404, detail=str(e))
+        raise HTTPException(status_code=404, detail=str(e)) from e
 
 
 @router.put("/{contact_id}/persons/{person_id}")
@@ -241,7 +239,7 @@ async def update_contact_person(
     try:
         return await contact_service.update_contact_person(db, tenant_id, user_id, contact_id, person_id, data)
     except ValueError as e:
-        raise HTTPException(status_code=404, detail=str(e))
+        raise HTTPException(status_code=404, detail=str(e)) from e
 
 
 @router.delete("/{contact_id}/persons/{person_id}", status_code=status.HTTP_204_NO_CONTENT)
@@ -256,7 +254,7 @@ async def delete_contact_person(
     try:
         await contact_service.delete_contact_person(db, tenant_id, contact_id, person_id)
     except ValueError as e:
-        raise HTTPException(status_code=404, detail=str(e))
+        raise HTTPException(status_code=404, detail=str(e)) from e
 
 
 # ── Deduplication / Merge endpoints (Task 5.23) ───────────────────────────────
@@ -292,7 +290,7 @@ async def merge_duplicate_contacts(
         source_uuid = uuid.UUID(body.source_contact_id)
         target_uuid = uuid.UUID(body.target_contact_id)
     except (ValueError, TypeError):
-        raise HTTPException(status_code=400, detail="Invalid contact ID")
+        raise HTTPException(status_code=400, detail="Invalid contact ID") from None
 
     source_access = await check_single_entity_access(
         db, "contact", source_uuid, user_id, tenant_id,