feat(B-SENS): Sensitive Data Boundary + AI/Data Exposure Policy + AIProvider Compliance

B-SENS: app/core/sensitive_data.py (NEU) — zentrale Sensitive-Field-Verwaltung
- SENSITIVE_FIELDS dict für contact/user/mail_account/system_settings
- is_sensitive(), sanitize_dict(), register_sensitive_fields()
- Integration: errors.py (Log-Redaction), audit.py (Audit-Masking), export_service.py (Export-Filter), embedding.py (Index-Filter)

B-DATA-POL: AI/Data Exposure Policy
- DATA_EXPOSURE_POLICY: pro Entity+Field welche Systeme erlaubt (llm_context/search/embeddings/rag/agent_memory/export)
- filter_for_llm_context/search/embeddings/export/rag/agent_memory()

B-AIPROV-COMP: AIProvider Compliance Metadata
- Migration 0119: 7 neue Spalten an ai_providers (region, hosting_type, dpa_status, retention_policy, training_on_customer_data, transfer_notice, allowed_data_classes)
- llm_client.py: get_provider_compliance() + check_data_class_allowed()

B-PRIV-TEST: 76 Tests in test_sensitive_data.py — alle grün
- Sensitive Fields, Exposure Policy, Provider Compliance, Secrets-always-blocked
- Keine Regression: 39 LLM-Client Tests grün

app/services/export_service.py

@@ -10,6 +10,7 @@ from typing import Any
 from sqlalchemy import select, func
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.sensitive_data import get_sensitive_fields
 from app.models.contact import Contact
 
 
@@ -48,21 +49,30 @@ class ExportService:
         result = await db.execute(base)
         contacts = result.scalars().all()
 
-        output = io.StringIO()
-        writer = csv.writer(output)
-        writer.writerow([
+        # Exclude sensitive fields that must never appear in exports
+        sensitive = get_sensitive_fields("contact")
+
+        all_headers = [
             "id", "type", "displayname", "name", "firstname", "surname", "code",
             "email_1", "email_2", "phone_1", "phone_2", "website",
             "mailing_city", "mailing_postalcode", "mailing_country",
             "vat_code", "tags",
-        ])
+        ]
+        # Drop headers for sensitive fields (e.g. password_hash would never be
+        # in a contact row, but this is a safety net).
+        export_headers = [h for h in all_headers if h not in sensitive]
+
+        output = io.StringIO()
+        writer = csv.writer(output)
+        writer.writerow(export_headers)
         for c in contacts:
-            writer.writerow([
-                str(c.id), c.type, c.displayname, c.name or "", c.firstname or "", c.surname or "",
-                c.code or "", c.email_1 or "", c.email_2 or "", c.phone_1 or "", c.phone_2 or "",
-                c.website or "", c.mailing_city or "", c.mailing_postalcode or "",
-                c.mailing_country or "", c.vat_code or "", c.tags or "",
-            ])
+            row = []
+            for h in export_headers:
+                if h in sensitive:
+                    row.append("")
+                else:
+                    row.append(getattr(c, h, None) or "")
+            writer.writerow(row)
         return output.getvalue()