Sicherheit + Tests + A11y, SW by-v1118

PYDANTIC max_length (38 Routen, ~400 Field-Constraints):
Schützt vor DoS durch Riesen-Payloads (10MB Thread-Titel etc.).
Pragmatische Limits:
- Titel/Name: 200 · Beschreibung/Body: 10000 · Notiz: 5000
- Email: 254 (RFC 5321) · URL: 500 · Slug/Kategorie: 100
- Hund-Name/Rasse: 80 · Hund-Bio: 2000

Top-betroffen: forum.py, diary.py, health.py, dogs.py, expenses.py,
notes.py, auth.py, profile.py. Manuelle len()-Checks in profile,
chat, ki entfernt (jetzt durch Field abgedeckt).

PYTEST COVERAGE (+19 Tests, 37 grün + 1 xfail):
- test_security.py: require_owner (Places GET/PATCH/DELETE mit
  Fremduser → 403), JWT-Blacklist (Logout invalidiert Token),
  Login-Lockout (5 Fehlversuche → 429 + Retry-After Header)
- test_race.py: Invoice-Counter (20 parallele Threads, alle unique),
  Founder-Number (atomare Vergabe, voll bei 100)
- test_validation.py: Forum-Titel 30k Zeichen → 422, Diary-Text
  50k → 422 (verifiziert Pydantic max_length-Sweep)

A11Y (Tap-Targets ≥44×44 + Dark-Mode-Kontrast):
- #header-user-btn 36→44px, .header-back 40→44, .header-menu-btn 40→44
- dog-profile Wrapped-Slider Prev/Next 40→44
- forum-Lightbox Close 40→44
- --c-text-muted Light: #B0A090 (2.37:1 FAIL) → #7F6B58 (4.74:1 PASS)
- --c-text-muted Dark:  #806A58 (3.58:1 FAIL) → #A08878 (5.46:1 PASS)
- Branding-Farben unangetastet

backend/routes/routen.py

@@ -5,7 +5,7 @@ import json, os, uuid
 import httpx
 import polyline as _polyline
 from fastapi import APIRouter, Depends, HTTPException, UploadFile, File
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from typing import Optional, List
 from database import db
 from auth import get_current_user, get_current_user_optional
@@ -37,29 +37,29 @@ class GPSPoint(BaseModel):
     alt: Optional[float] = None
 
 class RouteCreate(BaseModel):
-    name:            str
-    beschreibung:    Optional[str]         = None
+    name:            str                   = Field(..., min_length=1, max_length=200)
+    beschreibung:    Optional[str]         = Field(None, max_length=5000)
     gps_track:       List[GPSPoint]
     distanz_km:      Optional[float]       = None
     dauer_min:       Optional[int]         = None
-    schwierigkeit:   Optional[str]         = "leicht"   # leicht | mittel | anspruchsvoll
-    untergrund:      Optional[str]         = None        # wald | asphalt | wiese | mix
+    schwierigkeit:   Optional[str]         = Field("leicht", max_length=30)   # leicht | mittel | anspruchsvoll
+    untergrund:      Optional[str]         = Field(None, max_length=50)        # wald | asphalt | wiese | mix
     schatten:        Optional[bool]        = None
     leine_empfohlen: Optional[bool]        = None
     is_public:          Optional[bool]     = False
-    hunde_tauglichkeit: Optional[str]      = None  # eingeschränkt | gut | sehr_gut | premium
-    client_time:        Optional[str]      = None
+    hunde_tauglichkeit: Optional[str]      = Field(None, max_length=50)  # eingeschränkt | gut | sehr_gut | premium
+    client_time:        Optional[str]      = Field(None, max_length=64)
     dog_ids:            Optional[List[int]] = None  # Welche Hunde mitgegangen sind
 
 class RouteUpdate(BaseModel):
-    name:            Optional[str]  = None
-    beschreibung:    Optional[str]  = None
-    schwierigkeit:   Optional[str]  = None
-    untergrund:      Optional[str]  = None
+    name:            Optional[str]  = Field(None, max_length=200)
+    beschreibung:    Optional[str]  = Field(None, max_length=5000)
+    schwierigkeit:   Optional[str]  = Field(None, max_length=30)
+    untergrund:      Optional[str]  = Field(None, max_length=50)
     schatten:        Optional[bool] = None
     leine_empfohlen: Optional[bool] = None
     is_public:          Optional[bool] = None
-    hunde_tauglichkeit: Optional[str]  = None
+    hunde_tauglichkeit: Optional[str]  = Field(None, max_length=50)
 
 class RouteDogs(BaseModel):
     dog_ids: List[int]
@@ -553,7 +553,7 @@ async def add_route_photo(
 # POST /api/routes/{id}/feedback — Feedback an Route-Ersteller
 # ------------------------------------------------------------------
 class RouteFeedback(BaseModel):
-    text: str
+    text: str = Field(..., min_length=5, max_length=2000)
 
 @router.post("/{route_id}/feedback", status_code=201)
 async def route_feedback(route_id: int, data: RouteFeedback, user=Depends(get_current_user)):