Phase 2: Visibility Filter & Owner ID

- Add OwnedMixin to 15 models (contact_folder, user_preference, workspace,
  mcp_server_config, agent_definition, automation_definition, report_template,
  report_instance, entity_link, comm_conversation, proactive_suggestion,
  ai_agent, ai_chat_session, tag, share_link)
- Migration 0102: Add owner_id column to 15 tables with backfill from user_id
- Fix EntityPermission Registry: remove notification, add entity_attachment,
  entity_history, subtask, calendar, folder; fix wrong class names
  (DmsFile→File, CalendarEvent→CalendarEntry, Mailbox→MailAccount)
- Add apply_visibility_filter to list endpoints in tags, tasks, mcp_client,
  automation, report_generator, ai_assistant routes
- Add owner_id to create handlers for all new OwnedMixin models
- Patch tasks/services.py and automation/services.py list methods with
  user_id and is_system_admin parameters

app/plugins/builtins/permissions/models.py

@@ -10,6 +10,7 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin
+from app.models.owned_mixin import OwnedMixin
 
 
 class Permission(Base, TenantMixin):
@@ -37,7 +38,7 @@ class Permission(Base, TenantMixin):
     access_level: Mapped[str] = mapped_column(String(10), nullable=False, default="read")
 
 
-class ShareLink(Base, TenantMixin):
+class ShareLink(Base, TenantMixin, OwnedMixin):
     """Public share link for a file — optional password and expiry."""
 
     __tablename__ = "share_links"

app/plugins/builtins/permissions/routes.py

@@ -12,6 +12,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.auth import hash_password, verify_password
 from app.core.db import get_db
+from app.core.visibility import apply_visibility_filter
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.permissions.models import Permission, ShareLink
 from app.plugins.builtins.permissions.schemas import (
@@ -48,6 +49,7 @@ async def list_permissions(
 ):
     """List all permissions for a file."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
     fid = _parse_uuid(file_id, "file_id")
 
     result = await db.execute(
@@ -78,6 +80,7 @@ async def grant_permission(
 ):
     """Grant a permission on a file to a user."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
     fid = _parse_uuid(file_id, "file_id")
     user_id = _parse_uuid(body.user_id, "user_id")
     group_id = _parse_uuid(body.group_id, "group_id") if body.group_id else None
@@ -123,6 +126,7 @@ async def revoke_permission(
 ):
     """Revoke all permissions for a user on a file."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
     fid = _parse_uuid(file_id, "file_id")
     uid = _parse_uuid(user_id, "user_id")