Phase 2: Visibility Filter & Owner ID

- Add OwnedMixin to 15 models (contact_folder, user_preference, workspace,
  mcp_server_config, agent_definition, automation_definition, report_template,
  report_instance, entity_link, comm_conversation, proactive_suggestion,
  ai_agent, ai_chat_session, tag, share_link)
- Migration 0102: Add owner_id column to 15 tables with backfill from user_id
- Fix EntityPermission Registry: remove notification, add entity_attachment,
  entity_history, subtask, calendar, folder; fix wrong class names
  (DmsFile→File, CalendarEvent→CalendarEntry, Mailbox→MailAccount)
- Add apply_visibility_filter to list endpoints in tags, tasks, mcp_client,
  automation, report_generator, ai_assistant routes
- Add owner_id to create handlers for all new OwnedMixin models
- Patch tasks/services.py and automation/services.py list methods with
  user_id and is_system_admin parameters

app/plugins/builtins/tasks/services.py

@@ -9,6 +9,7 @@ from typing import Any
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.visibility import apply_visibility_filter
 from app.plugins.builtins.tasks.models import Task
 
 
@@ -40,10 +41,17 @@ async def list_tasks(
     assigned_to: str | None = None,
     contact_id: str | None = None,
     search: str | None = None,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """List tasks with filtering and pagination."""
     query = select(Task).where(Task.tenant_id == tenant_id, Task.deleted_at.is_(None))
 
+    if user_id and not is_system_admin:
+        query = await apply_visibility_filter(
+            db, query, "task", Task, user_id, tenant_id, is_system_admin
+        )
+
     if status:
         query = query.where(Task.status == status)
     if priority:
@@ -103,6 +111,7 @@ async def create_task(
         assigned_to=uuid.UUID(data["assigned_to"]) if data.get("assigned_to") else None,
         contact_id=uuid.UUID(data["contact_id"]) if data.get("contact_id") else None,
         created_by=user_id,
+        owner_id=user_id,
     )
     db.add(task)
     await db.flush()