T02: companies + contacts + import/export + N:M + soft-delete + GDPR + FTS

- Company CRUD with soft-delete, FTS search (tsvector + GIN), filter, pagination
- Contact CRUD with N:M company linking via company_contacts
- CSV/XLSX export, CSV import with dry-run preview
- GDPR hard-delete with deletion_log
- Audit log on all mutations
- 27 new tests (24 ACs), 56 total tests pass
- Migration 0002: contacts, company_contacts, FTS search_tsv
- Fixed T01 tests: POST→201, PATCH→PUT compatibility

app/main.py

@@ -10,7 +10,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from app.config import get_settings
 from app.core.middleware import CSRFMiddleware
 from app.core.db import close_engine
-from app.routes import auth, users, roles, tenants, health, notifications, companies
+from app.routes import auth, users, roles, tenants, health, notifications, companies, contacts, import_export
 
 
 @asynccontextmanager
@@ -42,6 +42,8 @@ def create_app() -> FastAPI:
     app.include_router(tenants.router)
     app.include_router(notifications.router)
     app.include_router(companies.router)
+    app.include_router(contacts.router)
+    app.include_router(import_export.router)
 
     return app