Sicherheit + Tests + A11y, SW by-v1118

PYDANTIC max_length (38 Routen, ~400 Field-Constraints):
Schützt vor DoS durch Riesen-Payloads (10MB Thread-Titel etc.).
Pragmatische Limits:
- Titel/Name: 200 · Beschreibung/Body: 10000 · Notiz: 5000
- Email: 254 (RFC 5321) · URL: 500 · Slug/Kategorie: 100
- Hund-Name/Rasse: 80 · Hund-Bio: 2000

Top-betroffen: forum.py, diary.py, health.py, dogs.py, expenses.py,
notes.py, auth.py, profile.py. Manuelle len()-Checks in profile,
chat, ki entfernt (jetzt durch Field abgedeckt).

PYTEST COVERAGE (+19 Tests, 37 grün + 1 xfail):
- test_security.py: require_owner (Places GET/PATCH/DELETE mit
  Fremduser → 403), JWT-Blacklist (Logout invalidiert Token),
  Login-Lockout (5 Fehlversuche → 429 + Retry-After Header)
- test_race.py: Invoice-Counter (20 parallele Threads, alle unique),
  Founder-Number (atomare Vergabe, voll bei 100)
- test_validation.py: Forum-Titel 30k Zeichen → 422, Diary-Text
  50k → 422 (verifiziert Pydantic max_length-Sweep)

A11Y (Tap-Targets ≥44×44 + Dark-Mode-Kontrast):
- #header-user-btn 36→44px, .header-back 40→44, .header-menu-btn 40→44
- dog-profile Wrapped-Slider Prev/Next 40→44
- forum-Lightbox Close 40→44
- --c-text-muted Light: #B0A090 (2.37:1 FAIL) → #7F6B58 (4.74:1 PASS)
- --c-text-muted Dark:  #806A58 (3.58:1 FAIL) → #A08878 (5.46:1 PASS)
- Branding-Farben unangetastet

backend/routes/ernaehrung.py

@@ -2,7 +2,7 @@
 
 import logging
 from fastapi import APIRouter, Depends, HTTPException, Request
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from typing import Optional
 from database import db
 from auth import get_current_user
@@ -16,18 +16,18 @@ logger = logging.getLogger(__name__)
 # Schemas
 # ------------------------------------------------------------------
 class FutterProfilUpdate(BaseModel):
-    futter_typ: Optional[str] = None   # trocken|nass|barf|mix
-    marke:      Optional[str] = None
+    futter_typ: Optional[str] = Field(None, max_length=50)   # trocken|nass|barf|mix
+    marke:      Optional[str] = Field(None, max_length=200)
     kcal_tag:   Optional[int] = None
     portionen:  Optional[int] = None
-    notizen:    Optional[str] = None
+    notizen:    Optional[str] = Field(None, max_length=5000)
 
 
 class KiBeratungRequest(BaseModel):
-    frage:     str
-    dog_name:  Optional[str] = None
-    rasse:     Optional[str] = None
-    alter:     Optional[str] = None
+    frage:     str             = Field(..., min_length=3, max_length=2000)
+    dog_name:  Optional[str]   = Field(None, max_length=80)
+    rasse:     Optional[str]   = Field(None, max_length=80)
+    alter:     Optional[str]   = Field(None, max_length=50)
     gewicht:   Optional[float] = None
     aktiv:     Optional[bool]  = None
 
@@ -183,20 +183,20 @@ _GASTRO_HINWEIS = "Magen-Darm-Symptome wie {label} treten meist innerhalb wenige
 
 
 class FutterEintragCreate(BaseModel):
-    datum:       str
-    uhrzeit:     str
-    futter_name: str
-    futter_typ:  Optional[str] = "trockenfutter"
+    datum:       str           = Field(..., max_length=32)
+    uhrzeit:     str           = Field(..., max_length=20)
+    futter_name: str           = Field(..., max_length=200)
+    futter_typ:  Optional[str] = Field("trockenfutter", max_length=50)
     menge_g:     Optional[int] = None
-    notiz:       Optional[str] = None
+    notiz:       Optional[str] = Field(None, max_length=2000)
 
 
 class ReaktionCreate(BaseModel):
-    datum:        str
-    uhrzeit:      str
-    reaktion_typ: str
+    datum:        str           = Field(..., max_length=32)
+    uhrzeit:      str           = Field(..., max_length=20)
+    reaktion_typ: str           = Field(..., max_length=100)
     intensitaet:  Optional[int] = 3
-    notiz:        Optional[str] = None
+    notiz:        Optional[str] = Field(None, max_length=2000)
 
 
 # ------------------------------------------------------------------