fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

app/services/plugin_service.py

@@ -93,6 +93,26 @@ class PluginService:
         try:
             record = await self._registry.activate(db, name)
             was_already_active = record.active and record.status == "active"
+
+            # Update permission registry at runtime so newly activated plugins
+            # are immediately usable without app restart (P0-10 fix).
+            if not was_already_active:
+                from app.core.permission_registry import (
+                    get_permission_registry,
+                    register_plugin_permissions,
+                )
+                plugin = self._registry.get_plugin(name)
+                if plugin and plugin.manifest.permissions:
+                    register_plugin_permissions(name, plugin.manifest.permissions)
+                # Add to active set so require_active_plugin() returns True
+                get_permission_registry()._active_plugins.add(name)
+
+                # Register entity models for permission system (P0-3 fix)
+                if plugin:
+                    from app.services.entity_permission_service import register_entity_model
+                    for entity_type, model_class in plugin.get_entity_models().items():
+                        register_entity_model(entity_type, model_class)
+
             if tenant_id and user_id:
                 await log_audit(
                     db,
@@ -137,6 +157,24 @@ class PluginService:
         try:
             record = await self._registry.deactivate(db, name)
             was_already_inactive = not record.active and record.status == "inactive"
+
+            # Update permission registry at runtime so deactivated plugins
+            # immediately stop being usable (P0-10 fix).
+            if not was_already_inactive:
+                from app.core.permission_registry import (
+                    get_permission_registry,
+                    unregister_plugin_permissions,
+                )
+                unregister_plugin_permissions(name)
+                get_permission_registry()._active_plugins.discard(name)
+
+                # Unregister entity models for permission system (P0-3 fix)
+                plugin = self._registry.get_plugin(name)
+                if plugin:
+                    from app.services.entity_permission_service import unregister_entity_model
+                    for entity_type in plugin.get_entity_models():
+                        unregister_entity_model(entity_type)
+
             if tenant_id and user_id:
                 await log_audit(
                     db,