fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

tests/test_cross_tenant_security.py

@@ -18,6 +18,7 @@ They use the real database connection (not mocks).
 from __future__ import annotations
 
 import asyncio
+import os
 import uuid
 from datetime import UTC, datetime
 from typing import Any
@@ -27,6 +28,8 @@ import pytest_asyncio
 from sqlalchemy import select, text
 from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
 
+os.environ.setdefault("SECRET_KEY", "test-secret-key-with-at-least-32-characters-for-testing-only!!")
+
 from app.core.db import Base, set_tenant_context, set_user_context
 from app.models.contact import Contact
 from app.models.tenant import Tenant
@@ -37,7 +40,7 @@ from app.core.visibility import apply_visibility_filter, check_single_entity_acc
 
 
 # Test database URL — uses the same DB as the app
-TEST_DB_URL = "postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm_test"
+TEST_DB_URL = os.environ.get("DATABASE_URL", "postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm_test")
 
 
 @pytest_asyncio.fixture
@@ -90,11 +93,13 @@ async def tenant_b(db_session: AsyncSession):
 @pytest_asyncio.fixture
 async def user_a(db_session: AsyncSession, tenant_a: Tenant):
     """Create a user in tenant A."""
+    from app.core.auth import hash_password
+
     user = User(
         id=uuid.uuid4(),
         name="User A",
         email="user-a@test-cross-tenant.local",
-        password_hash="$2b$12$testhash",
+        password_hash=hash_password("TestPass123!"),
         first_name="User",
         last_name="A",
 
@@ -119,11 +124,13 @@ async def user_a(db_session: AsyncSession, tenant_a: Tenant):
 @pytest_asyncio.fixture
 async def user_b(db_session: AsyncSession, tenant_b: Tenant):
     """Create a user in tenant B."""
+    from app.core.auth import hash_password
+
     user = User(
         id=uuid.uuid4(),
         name="User B",
         email="user-b@test-cross-tenant.local",
-        password_hash="$2b$12$testhash",
+        password_hash=hash_password("TestPass123!"),
         first_name="User",
         last_name="B",