Sicherheit + Tests + A11y, SW by-v1118

PYDANTIC max_length (38 Routen, ~400 Field-Constraints):
Schützt vor DoS durch Riesen-Payloads (10MB Thread-Titel etc.).
Pragmatische Limits:
- Titel/Name: 200 · Beschreibung/Body: 10000 · Notiz: 5000
- Email: 254 (RFC 5321) · URL: 500 · Slug/Kategorie: 100
- Hund-Name/Rasse: 80 · Hund-Bio: 2000

Top-betroffen: forum.py, diary.py, health.py, dogs.py, expenses.py,
notes.py, auth.py, profile.py. Manuelle len()-Checks in profile,
chat, ki entfernt (jetzt durch Field abgedeckt).

PYTEST COVERAGE (+19 Tests, 37 grün + 1 xfail):
- test_security.py: require_owner (Places GET/PATCH/DELETE mit
  Fremduser → 403), JWT-Blacklist (Logout invalidiert Token),
  Login-Lockout (5 Fehlversuche → 429 + Retry-After Header)
- test_race.py: Invoice-Counter (20 parallele Threads, alle unique),
  Founder-Number (atomare Vergabe, voll bei 100)
- test_validation.py: Forum-Titel 30k Zeichen → 422, Diary-Text
  50k → 422 (verifiziert Pydantic max_length-Sweep)

A11Y (Tap-Targets ≥44×44 + Dark-Mode-Kontrast):
- #header-user-btn 36→44px, .header-back 40→44, .header-menu-btn 40→44
- dog-profile Wrapped-Slider Prev/Next 40→44
- forum-Lightbox Close 40→44
- --c-text-muted Light: #B0A090 (2.37:1 FAIL) → #7F6B58 (4.74:1 PASS)
- --c-text-muted Dark:  #806A58 (3.58:1 FAIL) → #A08878 (5.46:1 PASS)
- Branding-Farben unangetastet

backend/routes/training.py

@@ -1,7 +1,7 @@
 """BAN YARO — Übungs- & Trainingsfortschritt"""
 
 from fastapi import APIRouter, Depends, HTTPException
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from typing import Optional
 import datetime
 import ki
@@ -61,9 +61,9 @@ async def get_exercises():
 # Admin: Übung bearbeiten (beschreibung / schritte / tipp)
 # ------------------------------------------------------------------
 class ExerciseUpdate(BaseModel):
-    beschreibung: Optional[str] = None
-    schritte:     Optional[str] = None  # JSON-String: '["Schritt 1", ...]'
-    tipp:         Optional[str] = None
+    beschreibung: Optional[str] = Field(None, max_length=10000)
+    schritte:     Optional[str] = Field(None, max_length=10000)  # JSON-String: '["Schritt 1", ...]'
+    tipp:         Optional[str] = Field(None, max_length=5000)
 
 @router.put("/exercises/{exercise_id}")
 async def update_exercise(exercise_id: int, body: ExerciseUpdate, _=Depends(require_admin)):
@@ -93,9 +93,9 @@ async def update_exercise(exercise_id: int, body: ExerciseUpdate, _=Depends(requ
 # Übungs-Status
 # ------------------------------------------------------------------
 class ProgressUpdate(BaseModel):
-    exercise_id: str
-    status: Optional[str] = None
-    dog_id: Optional[int] = None
+    exercise_id: str           = Field(..., max_length=200)
+    status:      Optional[str] = Field(None, max_length=50)
+    dog_id:      Optional[int] = None
 
 @router.get("/progress")
 async def get_progress(dog_id: Optional[int] = None, user=Depends(get_current_user)):
@@ -137,9 +137,9 @@ async def upsert_progress(body: ProgressUpdate, user=Depends(get_current_user)):
 # Trainingsplan-Checkboxen
 # ------------------------------------------------------------------
 class PlanProgress(BaseModel):
-    item_key: str
-    checked: bool
-    dog_id: Optional[int] = None
+    item_key: str           = Field(..., max_length=200)
+    checked:  bool
+    dog_id:   Optional[int] = None
 
 @router.get("/plan-progress")
 async def get_plan_progress(dog_id: Optional[int] = None, user=Depends(get_current_user)):
@@ -327,15 +327,15 @@ def _check_badges(conn, user_id: int, dog_name: str) -> list:
 
 class SessionCreate(BaseModel):
     dog_id: int
-    exercise_id: str
-    exercise_name: str
-    datum: Optional[str] = None
-    wiederholungen: int = 1
-    erfolgsquote: int = 50
-    hund_stimmung: Optional[str] = "aufmerksam"
+    exercise_id: str           = Field(..., max_length=200)
+    exercise_name: str         = Field(..., max_length=200)
+    datum: Optional[str]       = Field(None, max_length=32)
+    wiederholungen: int        = 1
+    erfolgsquote: int          = 50
+    hund_stimmung: Optional[str] = Field("aufmerksam", max_length=50)
     zufriedenheit: Optional[int] = 3
-    notiz: Optional[str] = None
-    tagebuch_eintrag: bool = False  # ignoriert — Training hat eigenes Protokoll
+    notiz: Optional[str]         = Field(None, max_length=2000)
+    tagebuch_eintrag: bool       = False  # ignoriert — Training hat eigenes Protokoll
 
 
 @router.post("/sessions")