fix(api): add input validation to PersonNameAliasDTO

Adds @NotBlank @Size(max=255) on lastName, @NotNull on type,
@Valid on controller parameter. Blank/null input now returns
400 instead of reaching the DB constraint. 2 new controller tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/java/org/raddatz/familienarchiv/controller/PersonController.java

@@ -104,7 +104,7 @@ public class PersonController {
 
     @PostMapping("/{id}/aliases")
     @RequirePermission(Permission.WRITE_ALL)
-    public PersonNameAlias addAlias(@PathVariable UUID id, @RequestBody PersonNameAliasDTO dto) {
+    public PersonNameAlias addAlias(@PathVariable UUID id, @Valid @RequestBody PersonNameAliasDTO dto) {
         return personService.addAlias(id, dto);
     }
 

backend/src/main/java/org/raddatz/familienarchiv/dto/PersonNameAliasDTO.java

@@ -1,9 +1,12 @@
 package org.raddatz.familienarchiv.dto;
 
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
 import org.raddatz.familienarchiv.model.PersonNameAliasType;
 
 public record PersonNameAliasDTO(
-        String lastName,
+        @NotBlank @Size(max = 255) String lastName,
-        String firstName,
+        @Size(max = 255) String firstName,
-        PersonNameAliasType type
+        @NotNull PersonNameAliasType type
 ) {}

backend/src/test/java/org/raddatz/familienarchiv/controller/PersonControllerTest.java

@@ -458,4 +458,22 @@ class PersonControllerTest {
         mockMvc.perform(delete("/api/persons/{id}/aliases/{aliasId}", UUID.randomUUID(), UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
+
+    @Test
+    @WithMockUser(authorities = "WRITE_ALL")
+    void addAlias_returns400_whenLastNameIsBlank() throws Exception {
+        mockMvc.perform(post("/api/persons/{id}/aliases", UUID.randomUUID())
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content("{\"lastName\":\"\",\"type\":\"BIRTH\"}"))
+                .andExpect(status().isBadRequest());
+    }
+
+    @Test
+    @WithMockUser(authorities = "WRITE_ALL")
+    void addAlias_returns400_whenTypeIsNull() throws Exception {
+        mockMvc.perform(post("/api/persons/{id}/aliases", UUID.randomUUID())
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content("{\"lastName\":\"de Gruyter\"}"))
+                .andExpect(status().isBadRequest());
+    }
 }