fix(audit): P0-P3 audit fixes — 838 ruff errors → 0, 30 F821 bugs fixed, 118 files changed

- P0: hooks.py 3-tuple fix, trigger_dispatcher Contract, contacts/plugin unregister_actions_by_owner
- P0: 5 test files — check_permission mocks removed, hardcoded DB credential → env var
- P1: attachment_service DmsFile via Contract helper, restore_registry/history_hooks dedup
- P1: mail/plugin restore unregister, mcp_client datetime.now(UTC), saved_views/filters patterns
- P1: ProtectedRoute fail-closed, 13 test assertion fixes (bcrypt, DB-URLs, SECRET_KEYs)
- P2: deprecated notifications → post_system_message (3 files), forgejo Base, report_generator lazy import
- P2: webhooks permissions, deps.py/roles.py plugin perms removed, import_export default
- P2: address/tags/entity_links patterns removed, worker.py Contract-Umgehungen fixed
- P2: 28 frontend TODOs (hardcoded constants, deprecated notification API)
- P3: dead code, duplicates, deprecated imports, private attr, __import__ inline
- P3: 8 frontend TODOs (LucideIcons, inline styles, XSS, i18n)
- ruff: 838 → 0 (612 auto-fix + 246 manual + 27 F821 regression fix)
- F821: 30 → 0 (AutomationDefinition, DmsFile, user_id, Path, Any, String)
- Contract-Umgehungen: 2 neue gefunden (worker.py:169, worker.py:280) und gefixt

tests/test_cross_tenant_standalone.py

@@ -18,7 +18,7 @@ from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
 os.environ["SESSION_COOKIE_SECURE"] = "false"
 os.environ["SESSION_COOKIE_SAMESITE"] = "lax"
 os.environ["ENVIRONMENT"] = "testing"
-os.environ["SECRET_KEY"] = "test-secret-key-for-testing-only-32chars"
+os.environ.setdefault("SECRET_KEY", "test-secret-key-for-testing-only-32chars")
 
 from app.core.db import set_tenant_context, set_user_context
 from app.models.contact import Contact
@@ -29,8 +29,11 @@ from app.services.entity_permission_service import get_effective_access, get_vis
 from app.core.visibility import apply_visibility_filter, check_single_entity_access
 
 
-# Use production DB (crm_user is superuser, RLS bypassed — tests Defense-in-Depth)
-DB_URL = "postgresql+asyncpg://crm_user:4B6X2wlfbIx-PyaG8kGutsatdLbjdBUI@crm-postgres:5432/crm_db"
+# Use DB from env (defaults to local test DB)
+DB_URL = os.environ.get(
+    "DATABASE_URL",
+    "postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm_test",
+)
 
 
 @pytest_asyncio.fixture
@@ -68,8 +71,10 @@ async def tenant_b(db: AsyncSession):
 
 @pytest_asyncio.fixture
 async def user_a(db: AsyncSession, tenant_a):
+    from app.core.auth import hash_password
+
     u = User(id=uuid.uuid4(), name="CT User A", email=f"ct-a-{uuid.uuid4().hex[:8]}@test.local",
-             password_hash="$2b$12$testhash", first_name="User", last_name="A",
+             password_hash=hash_password("TestPass123!"), first_name="User", last_name="A",
              is_active=True, is_system_admin=False)
     db.add(u)
     await db.flush()
@@ -81,8 +86,10 @@ async def user_a(db: AsyncSession, tenant_a):
 
 @pytest_asyncio.fixture
 async def user_b(db: AsyncSession, tenant_b):
+    from app.core.auth import hash_password
+
     u = User(id=uuid.uuid4(), name="CT User B", email=f"ct-b-{uuid.uuid4().hex[:8]}@test.local",
-             password_hash="$2b$12$testhash", first_name="User", last_name="B",
+             password_hash=hash_password("TestPass123!"), first_name="User", last_name="B",
              is_active=True, is_system_admin=False)
     db.add(u)
     await db.flush()