feat(N1): Scope-Registry via Contract — workspace_scopes() Deklarationen + /scope-definitions Endpoint (#365)

- workspace_scopes() Contract-Hook (document_placeholders-Muster): Plugins deklarieren Scope-Dimensionen inkl. Wertequellen
- Deklarationen: contacts (Ordner/Typen/Saved-View), dms (Ordner/Datei-Typen), mail (Postfächer), calendar (Kalender/Standard-Ansicht)
- Pydantic fail-closed (schemas/workspace.py): ScopeOption, ScopeValueSource (nur interne /api/v1-Pfade, SSRF-sicher), WorkspaceScopeDimension, WorkspaceModuleScopes
- Aggregator workspace_scope_service.py: discovered-Plugins, ARCH-014-safe, Crash-sicher, ungültige Deklarationen verworfen
- GET /api/v1/workspaces/scope-definitions (workspaces:configure_modules) vor /{workspace_id} registriert
- Security-Invariante: Scope = reine UND-Einschränkung (Workspace ∧ RLS ∧ ABAC ∧ Permissions)
- Tests: 18/18 neu (TDD rot→grün), Regression 17/17, Checker 0 Verstöße, Ruff clean
- Doku: api-documentation.md Workspaces-Sektion, PROGRESS.md Phase N1

app/plugins/builtins/dms/contracts.py

@@ -15,6 +15,40 @@ class DmsContract:
     DmsFile = DmsFile
     Folder = Folder
 
+    @staticmethod
+    def workspace_scopes() -> list[dict]:
+        """Scope-Dimensionen des dms-Moduls für den Workspace-Editor (N1)."""
+        return [
+            {
+                "module_key": "dms",
+                "dimensions": [
+                    {
+                        "key": "folder_ids",
+                        "label": "DMS-Ordner",
+                        "control": "multiselect",
+                        "value_source": {
+                            "endpoint": "/api/v1/dms/folders",
+                            "items_path": "",
+                            "value_key": "id",
+                            "label_key": "name",
+                        },
+                    },
+                    {
+                        "key": "file_types",
+                        "label": "Datei-Typen",
+                        "control": "multiselect",
+                        "options": [
+                            {"value": "application/pdf", "label": "PDF"},
+                            {"value": "image/", "label": "Bilder"},
+                            {"value": "spreadsheet", "label": "Tabellen"},
+                            {"value": "word", "label": "Dokumente"},
+                            {"value": "other", "label": "Sonstige"},
+                        ],
+                    },
+                ],
+            }
+        ]
+
     @classmethod
     def get_function(cls, name: str):
         """Return a callable exposed by this contract, or None if absent."""