Sicherheit + Tests + A11y, SW by-v1118

PYDANTIC max_length (38 Routen, ~400 Field-Constraints):
Schützt vor DoS durch Riesen-Payloads (10MB Thread-Titel etc.).
Pragmatische Limits:
- Titel/Name: 200 · Beschreibung/Body: 10000 · Notiz: 5000
- Email: 254 (RFC 5321) · URL: 500 · Slug/Kategorie: 100
- Hund-Name/Rasse: 80 · Hund-Bio: 2000

Top-betroffen: forum.py, diary.py, health.py, dogs.py, expenses.py,
notes.py, auth.py, profile.py. Manuelle len()-Checks in profile,
chat, ki entfernt (jetzt durch Field abgedeckt).

PYTEST COVERAGE (+19 Tests, 37 grün + 1 xfail):
- test_security.py: require_owner (Places GET/PATCH/DELETE mit
  Fremduser → 403), JWT-Blacklist (Logout invalidiert Token),
  Login-Lockout (5 Fehlversuche → 429 + Retry-After Header)
- test_race.py: Invoice-Counter (20 parallele Threads, alle unique),
  Founder-Number (atomare Vergabe, voll bei 100)
- test_validation.py: Forum-Titel 30k Zeichen → 422, Diary-Text
  50k → 422 (verifiziert Pydantic max_length-Sweep)

A11Y (Tap-Targets ≥44×44 + Dark-Mode-Kontrast):
- #header-user-btn 36→44px, .header-back 40→44, .header-menu-btn 40→44
- dog-profile Wrapped-Slider Prev/Next 40→44
- forum-Lightbox Close 40→44
- --c-text-muted Light: #B0A090 (2.37:1 FAIL) → #7F6B58 (4.74:1 PASS)
- --c-text-muted Dark:  #806A58 (3.58:1 FAIL) → #A08878 (5.46:1 PASS)
- Branding-Farben unangetastet

backend/routes/ki.py

@@ -1,6 +1,6 @@
 """BAN YARO — KI Routes"""
 from fastapi import APIRouter, Depends, HTTPException, Request, UploadFile, File
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from typing import Optional
 import ki as ki_module
 from auth import get_current_user
@@ -11,9 +11,9 @@ router = APIRouter()
 
 
 class TrainingRequest(BaseModel):
-    problem: str
-    rasse:   Optional[str] = None
-    alter:   Optional[str] = None
+    problem: str           = Field(..., min_length=10, max_length=1000)
+    rasse:   Optional[str] = Field(None, max_length=80)
+    alter:   Optional[str] = Field(None, max_length=50)
 
 
 @router.post("/training")
@@ -23,8 +23,6 @@ async def ki_training(req: TrainingRequest, request: Request,
     rl_check(request, max_requests=10, window_seconds=3600, key="ki_training")
     if not req.problem or len(req.problem.strip()) < 10:
         raise HTTPException(400, "Bitte beschreibe das Problem genauer.")
-    if len(req.problem) > 1000:
-        raise HTTPException(400, "Beschreibung zu lang (max. 1000 Zeichen).")
 
     rasse = req.rasse or "unbekannt"
     alter = req.alter or "unbekannt"
@@ -69,10 +67,10 @@ Schreibe klar und strukturiert, ohne unnötigen Fachjargon."""
 # POST /ki/tierarzt — KI-Tierarztfragen
 # ------------------------------------------------------------------
 class TierarztRequest(BaseModel):
-    symptom:  str
+    symptom:  str            = Field(..., min_length=5, max_length=1000)
     dog_id:   Optional[int]  = None
-    dog_name: Optional[str]  = None
-    rasse:    Optional[str]  = None
+    dog_name: Optional[str]  = Field(None, max_length=80)
+    rasse:    Optional[str]  = Field(None, max_length=80)
 
 
 @router.post("/tierarzt")
@@ -81,8 +79,6 @@ async def ki_tierarzt(req: TierarztRequest, request: Request,
     """KI-Tierarztfragen: Symptombeschreibung → erste Einschätzung."""
     if not req.symptom or len(req.symptom.strip()) < 5:
         raise HTTPException(400, "Bitte beschreibe das Symptom genauer.")
-    if len(req.symptom) > 1000:
-        raise HTTPException(400, "Beschreibung zu lang (max. 1000 Zeichen).")
 
     # Rate-Limit: max 5 Anfragen pro User pro Tag
     with db() as conn:
@@ -173,10 +169,10 @@ def _log_rasse_request(user_id: int):
 
 class BirthdayRequest(BaseModel):
     dog_id: int
-    name:   str
-    rasse:  Optional[str] = None
+    name:   str           = Field(..., max_length=80)
+    rasse:  Optional[str] = Field(None, max_length=80)
     alter:  Optional[int] = None
-    mode:   str = "tomorrow"  # "tomorrow" | "today"
+    mode:   str           = Field("tomorrow", max_length=20)  # "tomorrow" | "today"
 
 @router.post("/geburtstag")
 async def ki_geburtstag(req: BirthdayRequest, request: Request,
@@ -368,12 +364,12 @@ Falls kein Hund erkennbar: ist_hund=false und leeres rassen-Array."""
 # ------------------------------------------------------------------
 class AbschiedRequest(BaseModel):
     dog_id:   int
-    name:     str
-    rasse:    Optional[str] = None
+    name:     str             = Field(..., max_length=80)
+    rasse:    Optional[str]   = Field(None, max_length=80)
     km_total: Optional[float] = None
     diary_count: Optional[int] = None
     gemeinsam_tage: Optional[int] = None
-    last_entry_titel: Optional[str] = None
+    last_entry_titel: Optional[str] = Field(None, max_length=200)
 
 @router.post("/abschied")
 async def ki_abschied(req: AbschiedRequest, request: Request,