Phase 2: Visibility Filter & Owner ID

- Add OwnedMixin to 15 models (contact_folder, user_preference, workspace,
  mcp_server_config, agent_definition, automation_definition, report_template,
  report_instance, entity_link, comm_conversation, proactive_suggestion,
  ai_agent, ai_chat_session, tag, share_link)
- Migration 0102: Add owner_id column to 15 tables with backfill from user_id
- Fix EntityPermission Registry: remove notification, add entity_attachment,
  entity_history, subtask, calendar, folder; fix wrong class names
  (DmsFile→File, CalendarEvent→CalendarEntry, Mailbox→MailAccount)
- Add apply_visibility_filter to list endpoints in tags, tasks, mcp_client,
  automation, report_generator, ai_assistant routes
- Add owner_id to create handlers for all new OwnedMixin models
- Patch tasks/services.py and automation/services.py list methods with
  user_id and is_system_admin parameters

app/plugins/builtins/ai_assistant/models.py

@@ -19,6 +19,7 @@ from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin
+from app.models.owned_mixin import OwnedMixin
 
 
 # --- Providers ---
@@ -101,7 +102,7 @@ class AIPreset(Base, TenantMixin):
 
 # --- Agents ---
 
-class AIAgent(Base, TenantMixin):
+class AIAgent(Base, TenantMixin, OwnedMixin):
     """AI agent with system prompt and assigned tools."""
 
     __tablename__ = "ai_agents"
@@ -128,7 +129,7 @@ class AIAgent(Base, TenantMixin):
 
 # --- Chat Sessions ---
 
-class AIChatSession(Base, TenantMixin):
+class AIChatSession(Base, TenantMixin, OwnedMixin):
     """Chat session for a user with a specific agent."""
 
     __tablename__ = "ai_chat_sessions"

app/plugins/builtins/ai_assistant/routes.py

@@ -330,9 +330,13 @@ async def list_agents(
     db: AsyncSession = Depends(get_db),
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
-    result = await db.execute(
-        select(AIAgent).where(AIAgent.tenant_id == tenant_id)
+    user_id = uuid.UUID(current_user["user_id"])
+    is_system_admin = current_user.get("is_system_admin", False)
+    query = select(AIAgent).where(AIAgent.tenant_id == tenant_id)
+    query = await apply_visibility_filter(
+        db, query, "ai_agent", AIAgent, user_id, tenant_id, is_system_admin
     )
+    result = await db.execute(query)
     agents = list(result.scalars().all())
     return [agent_to_response(a) for a in agents]
 
@@ -344,6 +348,7 @@ async def create_agent(
     db: AsyncSession = Depends(get_db),
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
     await set_tenant_context(db, tenant_id)
 
     agent = AIAgent(
@@ -355,6 +360,7 @@ async def create_agent(
         is_active=data.is_active,
         config=data.config,
         tenant_id=tenant_id,
+        owner_id=user_id,
     )
     db.add(agent)
     await db.commit()
@@ -422,10 +428,13 @@ async def list_sessions(
 ):
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_system_admin = current_user.get("is_system_admin", False)
     stmt = (
         select(AIChatSession)
         .where(AIChatSession.tenant_id == tenant_id)
-        .where(AIChatSession.user_id == user_id)
+    )
+    stmt = await apply_visibility_filter(
+        db, stmt, "ai_chat_session", AIChatSession, user_id, tenant_id, is_system_admin
     )
     if is_sidebar is not None:
         stmt = stmt.where(AIChatSession.is_sidebar == is_sidebar)
@@ -470,6 +479,7 @@ async def create_session(
         is_sidebar=data.is_sidebar,
         folder_id=folder_id,
         tenant_id=tenant_id,
+        owner_id=user_id,
     )
     db.add(session)
     await db.commit()