feat(N1): Scope-Registry via Contract — workspace_scopes() Deklarationen + /scope-definitions Endpoint (#365)

- workspace_scopes() Contract-Hook (document_placeholders-Muster): Plugins deklarieren Scope-Dimensionen inkl. Wertequellen
- Deklarationen: contacts (Ordner/Typen/Saved-View), dms (Ordner/Datei-Typen), mail (Postfächer), calendar (Kalender/Standard-Ansicht)
- Pydantic fail-closed (schemas/workspace.py): ScopeOption, ScopeValueSource (nur interne /api/v1-Pfade, SSRF-sicher), WorkspaceScopeDimension, WorkspaceModuleScopes
- Aggregator workspace_scope_service.py: discovered-Plugins, ARCH-014-safe, Crash-sicher, ungültige Deklarationen verworfen
- GET /api/v1/workspaces/scope-definitions (workspaces:configure_modules) vor /{workspace_id} registriert
- Security-Invariante: Scope = reine UND-Einschränkung (Workspace ∧ RLS ∧ ABAC ∧ Permissions)
- Tests: 18/18 neu (TDD rot→grün), Regression 17/17, Checker 0 Verstöße, Ruff clean
- Doku: api-documentation.md Workspaces-Sektion, PROGRESS.md Phase N1

app/routes/workspaces.py

@@ -126,6 +126,25 @@ async def workspace_context(
     return ctx
 
 
+@router.get("/scope-definitions")
+async def workspace_scope_definitions(
+    current_user: dict = Depends(require_permission("workspaces:configure_modules")),
+):
+    """N1: Scope-Dimensionen aller Module für den Workspace-Editor.
+
+    Aggregiert ``workspace_scopes()``-Contract-Beiträge der Plugins
+    (document_placeholders-Muster): pro module_key die filterbaren
+    Dimensionen inkl. Wertequellen. Der N2-Editor rendert daraus das
+    Filter-UI; die Werte landen in ``workspace_modules.config``.
+
+    Admin-only: Scope-Definitionen konfigurieren Module-Teilmengen —
+    das ist Workspace-Admin-Kontext (configure_modules), kein Lesen.
+    """
+    from app.services.workspace_scope_service import get_scope_definitions
+
+    return {"modules": get_scope_definitions()}
+
+
 @router.post("", status_code=status.HTTP_201_CREATED)
 async def create_workspace(
     body: WorkspaceCreate,