refactor(d3): ARCH-051 — 14 dict-body-Routes auf Pydantic-Schemas umgestellt (entity_permissions bulk ×2, guests invite, users menu-order, system_settings backup-config+dsar, knowledge ×3, self_improvement ×5); DSAR-Export F821-Bug behoben (datetime/timezone undefined → NameError beim GDPR-Export), Zeitstempel auf datetime.now(UTC); Validierung jetzt im Schema statt in Routen

app/routes/users.py

@@ -6,6 +6,7 @@ import uuid
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
+from pydantic import BaseModel, Field
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -23,6 +24,12 @@ from app.services.user_service import _UNSET, user_service
 router = APIRouter(prefix="/api/v1/users", tags=["users"])
 
 
+class MenuOrderRequest(BaseModel):
+    """Update the current user's menu order preference."""
+
+    menu_order: list[str] = Field(..., min_length=0)
+
+
 def _parse_role_id(raw: str | None) -> uuid.UUID | None:
     """Convert a string body value into a UUID or None.
 
@@ -368,19 +375,14 @@ async def get_menu_order(
 
 @router.put("/me/menu-order")
 async def update_menu_order(
-    body: dict,
+    body: MenuOrderRequest,
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(get_current_user),
 ):
     """Update the current user's menu order preference."""
     user_id = uuid.UUID(current_user["user_id"])
 
-    menu_order = body.get("menu_order")
-    if not isinstance(menu_order, list) or not all(isinstance(x, str) for x in menu_order):
-        raise HTTPException(
-            400,
-            detail={"detail": "menu_order must be a list of strings", "code": "invalid_format"},
-        )
+    menu_order = body.menu_order
 
     result = await db.execute(
         select(User).where(User.id == user_id)