refactor(#11-Kritik): Contacts-Entities aus statischem Core-Registry entfernt — ContactsPlugin.get_entity_models() ist Single Source (contact/contacts/company); conftest spiegelt Produktions-Bootstrap idempotent (autouse-Fixture); Regressionstests beweisen Plugin-Registrierung; 12 ACL-Batch-Failures per Stash-Test als Vorbestand bewiesen (Suite-Isolation, identisch auf clean HEAD)

app/services/entity_permission_service.py

@@ -29,7 +29,6 @@ from app.core.notifications import post_system_message
 from app.models.address import Address
 from app.models.attachment import Attachment
 from app.models.bank_account import BankAccount
-from app.models.contact import Contact
 from app.models.contact_folder import ContactFolder
 from app.models.custom_field_definition import CustomFieldDefinition
 from app.models.entity_permission import EntityPermission
@@ -53,11 +52,10 @@ logger = logging.getLogger(__name__)
 # This replaces insecure text(f"SELECT ... FROM {entity_type}s") queries
 # with safe SQLAlchemy model-based queries (prevents SQL injection).
 ENTITY_MODELS: dict[str, type] = {
-    # Core models only — plugin models are registered dynamically
-    # via plugin.get_entity_models() at activation time (P0-3 fix).
-    "contact": Contact,
-    "contacts": Contact,
-    "company": Contact,
+    # Core models only — plugin models (incl. contacts: contact/contacts/company)
+    # are registered dynamically via plugin.get_entity_models() at activation
+    # time (P0-3 fix). The contacts entries were duplicated here historically
+    # — ContactsPlugin.get_entity_models() is the single source of truth.
     "address": Address,
     "attachment": Attachment,
     "bank_account": BankAccount,