fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

tests/test_cross_tenant_security_v2.py

@@ -34,7 +34,7 @@ from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
 os.environ["SESSION_COOKIE_SECURE"] = "false"
 os.environ["SESSION_COOKIE_SAMESITE"] = "lax"
 os.environ["ENVIRONMENT"] = "testing"
-os.environ["SECRET_KEY"] = "test-secret-key-with-at-least-32-characters-for-testing-only!!"
+os.environ.setdefault("SECRET_KEY", "test-secret-key-with-at-least-32-characters-for-testing-only!!")
 
 from app.core.db import set_tenant_context
 from app.models.contact import Contact
@@ -119,6 +119,8 @@ async def api_session(api_engine):
 @pytest_asyncio.fixture
 async def seed_data(admin_session: AsyncSession):
     """Seed two tenants with contacts using admin (superuser) connection."""
+    from app.core.auth import hash_password
+
     tenant_a = Tenant(id=uuid.uuid4(), name="RLS Tenant A", slug=f"rls-a-{uuid.uuid4().hex[:8]}")
     tenant_b = Tenant(id=uuid.uuid4(), name="RLS Tenant B", slug=f"rls-b-{uuid.uuid4().hex[:8]}")
     admin_session.add_all([tenant_a, tenant_b])
@@ -128,7 +130,7 @@ async def seed_data(admin_session: AsyncSession):
         id=uuid.uuid4(),
         name="RLS User A",
         email=f"rls-a-{uuid.uuid4().hex[:8]}@test.local",
-        password_hash="$2b$12$testhash",
+        password_hash=hash_password("TestPass123!"),
         is_active=True,
         is_system_admin=False,
     )
@@ -136,7 +138,7 @@ async def seed_data(admin_session: AsyncSession):
         id=uuid.uuid4(),
         name="RLS User B",
         email=f"rls-b-{uuid.uuid4().hex[:8]}@test.local",
-        password_hash="$2b$12$testhash",
+        password_hash=hash_password("TestPass123!"),
         is_active=True,
         is_system_admin=False,
     )