refactor(d3): ARCH-051 — 14 dict-body-Routes auf Pydantic-Schemas umgestellt (entity_permissions bulk ×2, guests invite, users menu-order, system_settings backup-config+dsar, knowledge ×3, self_improvement ×5); DSAR-Export F821-Bug behoben (datetime/timezone undefined → NameError beim GDPR-Export), Zeitstempel auf datetime.now(UTC); Validierung jetzt im Schema statt in Routen

app/routes/guests.py

@@ -14,6 +14,7 @@ import secrets
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
+from pydantic import BaseModel, EmailStr, Field
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -27,6 +28,13 @@ router = APIRouter(prefix="/api/v1/guests", tags=["guests"])
 settings = get_settings()
 
 
+class GuestInviteRequest(BaseModel):
+    """Invite a guest user."""
+
+    email: EmailStr
+    name: str = Field(..., min_length=1, max_length=200)
+
+
 def _hash_token(token: str) -> str:
     """Hash a token using SHA-256."""
     return hashlib.sha256(token.encode()).hexdigest()
@@ -35,7 +43,7 @@ def _hash_token(token: str) -> str:
 @router.post("/invite")
 async def invite_guest(
     request: Request,
-    body: dict,
+    body: GuestInviteRequest,
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_admin),
 ):
@@ -43,13 +51,8 @@ async def invite_guest(
 
     ⚠️ Guest-System umgebaut — Guests sind jetzt reguläre User mit role=guest
     """
-    email = body.get("email", "")
-    name = body.get("name", "")
-    if not email or not name:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail={"detail": "Email and name required", "code": "missing_fields"},
-        )
+    email = body.email
+    name = body.name
 
     tenant_id = uuid.UUID(current_user["tenant_id"])