fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

app/services/backup_service.py

@@ -6,7 +6,7 @@ import asyncio
 import logging
 import os
 import uuid
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from pathlib import Path
 
 from sqlalchemy import select
@@ -97,7 +97,7 @@ async def create_backup(
     """
     _ensure_backup_dir()
 
-    timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    timestamp = datetime.now(UTC).strftime("%Y%m%d_%H%M%S")
     filename = f"leocrm_backup_{tenant_id}_{timestamp}.dump"
     filepath = BACKUP_DIR / filename
 
@@ -223,7 +223,7 @@ async def restore_backup(
 
         # Run pg_restore in a subprocess — atomic at the DB level via pg_restore --clean
         import subprocess
-        result = subprocess.run(cmd, env=env, capture_output=True, text=True, timeout=300)
+        result = subprocess.run(cmd, env=env, capture_output=True, text=True, timeout=300)  # noqa: ASYNC221
         if result.returncode != 0:
             logger.error("pg_restore failed: %s", result.stderr)
             backup.status = "failed"
@@ -232,7 +232,7 @@ async def restore_backup(
             raise RuntimeError(f"pg_restore failed: {result.stderr[:200]}")
 
         backup.status = "restored"
-        backup.restored_at = datetime.now(timezone.utc)
+        backup.restored_at = datetime.now(UTC)
         await db.commit()
         logger.info("Backup %s restored successfully", backup_id)
         return backup
@@ -244,28 +244,6 @@ async def restore_backup(
         await db.commit()
         raise
 
-        logger.info("Running pg_restore: %s", cmd)
-
-        process = await asyncio.create_subprocess_exec(
-            *cmd,
-            env=env,
-            stdout=asyncio.subprocess.PIPE,
-            stderr=asyncio.subprocess.PIPE,
-        )
-        stdout, stderr = await process.communicate()
-
-        if process.returncode != 0:
-            error_msg = stderr.decode() if stderr else "pg_restore failed with unknown error"
-            logger.error("pg_restore failed: %s", error_msg)
-            raise RuntimeError(f"Restore failed: {error_msg}")
-
-        logger.info("Restore completed from backup: %s", backup.filename)
-        return backup
-
-    except Exception as exc:
-        logger.exception("Restore failed")
-        raise
-
 
 async def delete_backup(
     db: AsyncSession,