fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

tests/conftest.py

@@ -47,55 +47,29 @@ from app.models.tenant import Tenant
 from app.models.user import User, UserTenant
 from app.models.user_preference import UserPreference  # noqa: F401
 from app.models.workflow import Workflow, WorkflowInstance, WorkflowStepHistory  # noqa: F401
-from app.plugins.builtins.calendar import CalendarPlugin  # noqa: F401
-from app.plugins.builtins.mcp_server import McpServerPlugin  # noqa: F401
-from app.plugins.builtins.mcp_client import McpClientPlugin  # noqa: F401
-from app.plugins.builtins.mcp_client.models import McpServerConfig  # noqa: F401
-from app.plugins.builtins.calendar.models import (  # noqa: F401
-    Calendar,
-    CalendarEntry,
-    CalendarEntryLink,
-    CalendarShare,
-    Resource,
-    ResourceBooking,
-    Subtask,
-    UserCalendarVisibility,
-)
-from app.plugins.builtins.dms import DmsPlugin  # noqa: F401
-from app.plugins.builtins.dms.models import File as DmsFile  # noqa: F401
-from app.plugins.builtins.dms.models import Folder  # noqa: F401
-from app.plugins.builtins.entity_links.models import EntityLink  # noqa: F401
-from app.plugins.builtins.mail import MailPlugin  # noqa: F401
-from app.plugins.builtins.mail.models import (  # noqa: F401
-    ContactPgpKey,
-    MailAccount,
-    MailAccountDelegate,
-    MailAccountSendPermission,
-    MailAttachment,
-    MailFolder,
-    MailLabel,
-    MailLabelAssignment,
-    MailRule,
-    MailSeenBy,
-    MailSignature,
-    MailTemplate,
-    PgpKey,
-    VacationSentLog,
-)
-from app.plugins.builtins.permissions import PermissionsPlugin  # noqa: F401
-from app.plugins.builtins.permissions.models import Permission, ShareLink  # noqa: F401
-from app.plugins.builtins.report_generator import ReportGeneratorPlugin  # noqa: F401
-from app.plugins.builtins.report_generator.models import (  # noqa: F401
-    ReportInstance,
-    ReportTemplate,
-)
-from app.plugins.builtins.tags.models import Tag, TagAssignment  # noqa: F401
-from app.plugins.builtins.tasks import TasksPlugin  # noqa: F401
-from app.plugins.builtins.tasks.models import Task  # noqa: F401
 from app.models.outbox import EventOutbox  # noqa: F401
 from app.models.consumer_inbox import ConsumerInbox  # noqa: F401
 from app.models.outbox_delivery import OutboxDelivery  # noqa: F401
 from app.models.saved_filter import SavedFilter  # noqa: F401
+
+# Dynamically import all plugin models so Base.metadata.create_all() includes their tables.
+# This replaces ~30 hardcoded plugin imports with dynamic discovery (P1-14 fix).
+from app.plugins.registry import get_registry
+_registry = get_registry()
+_registry.discover_builtins()
+for _plugin_name in _registry.list_discovered():
+    _plugin = _registry.get_plugin(_plugin_name)
+    if _plugin is not None:
+        # Importing get_entity_models() triggers model class imports
+        # which registers them with Base.metadata
+        _plugin.get_entity_models()
+        # Also import the plugin's __init__ to ensure all models are loaded
+        import importlib
+        try:
+            importlib.import_module(f"app.plugins.builtins.{_plugin_name}")
+        except Exception:
+            pass
+
 from app.plugins.registry import reset_registry_for_testing  # noqa: F401
 from app.core.permission_registry import init_permission_registry  # noqa: F401
 from app.services.plugin_service import reset_plugin_service_for_testing  # noqa: F401