Phase 5.1-5.4: PWA, Public Plugin Endpoints, Contacts Embedding, Search Coverage

5.1 Public Plugin Endpoints:
- PluginRouteDef.is_public field in manifest.py
- main.py: public routes mounted without auth dependency
- permissions/public_routes.py: token-based share link access (info, verify, download)
- permissions/plugin.py: public share route registered with is_public=True

5.2 PWA:
- vite.config.ts: VitePWA plugin configured (autoUpdate, workbox, runtime caching)
- frontend/public/manifest.json: PWA manifest with icons
- index.html: theme-color, manifest link, apple-touch-icon, apple-mobile-web-app meta
- Build generates sw.js + workbox (90 precache entries)

5.3 Contacts Embedding:
- contact.py: embedding column (Vector(768)) added to Contact model
- Migration 0002_embeddings.sql already exists (adds embedding + HNSW index)
- ContactSearchProvider already queries embedding column

5.4 Search Coverage:
- 5 new search providers: task, contactperson, tag, conversation, user
- All providers implement FTS search with tenant_id + deleted_at filters
- TagSearchProvider also supports vector search (384-dim embedding)
- provider_registry.py: all 5 new providers auto-registered
- Total: 10 search providers (was 5)

app/main.py

@@ -488,17 +488,21 @@ def create_app() -> FastAPI:
                         try:
                             router_module = importlib.import_module(route_def.module)
                             router = getattr(router_module, route_def.router_attr)
-                            # Skip WebSocket routes — no wrapping, no plugin check
+                            # Check if this route definition is public (no auth required)
+                            is_public = getattr(route_def, "is_public", False)
                             from starlette.routing import WebSocketRoute
+                            if is_public:
+                                # Public routes: no auth dependency, no plugin check
+                                app.include_router(router)
+                                logger.info(f"Registered PUBLIC routes for {plugin_name}: {route_def.module}")
+                                continue
                             plugin_dep = Depends(require_active_plugin(plugin_name))
                             for route in router.routes:
                                 if isinstance(route, WebSocketRoute):
-                                    # WebSocket routes also need plugin check — don't skip (P1.9 fix)
                                     if not hasattr(route, 'dependencies'):
                                         route.dependencies = []
                                     route.dependencies.append(plugin_dep)
                                     continue
-                                # Add require_active_plugin to each HTTP route's dependencies
                                 if not hasattr(route, 'dependencies'):
                                     route.dependencies = []
                                 route.dependencies.append(plugin_dep)