fix(validators): restore SystemConfigUpdate validators broken by misplaced classes

The two new NetbirdClientAutoUpdatePayload/NetbirdApiTokenPayload classes
were accidentally inserted between two of SystemConfigUpdate's own
@field_validator methods, which closed that class early — the ssl_mode,
base_domain, npm_api_url, and admin_email validators ended up attached to
NetbirdApiTokenPayload instead, whose fields don't exist. Pydantic raised
PydanticUserError on import, crash-looping the whole appliance container.
Moved the two new classes after all of SystemConfigUpdate's validators.

app/utils/validators.py

@@ -177,27 +177,6 @@ class SystemConfigUpdate(BaseModel):
             raise ValueError("auto_update_check_time must be in HH:MM 24h format")
         return v
 
-
-# ---------------------------------------------------------------------------
-# NetBird client (peer) automatic updates
-# ---------------------------------------------------------------------------
-class NetbirdClientAutoUpdatePayload(BaseModel):
-    """Push a client auto-update version/mode to one or all customers."""
-
-    version: str = Field(..., max_length=50, description="'latest', 'disabled', or a version e.g. '0.61.0'")
-    always: bool = False
-
-
-class NetbirdApiTokenPayload(BaseModel):
-    """Manually register a NetBird Personal Access Token for a customer.
-
-    Needed for customers deployed before automatic PAT capture existed —
-    create a PAT once in that customer's own NetBird dashboard
-    (Settings > Service Users / Personal Access Tokens) and paste it here.
-    """
-
-    token: str = Field(..., min_length=10, max_length=500)
-
     @field_validator("ssl_mode")
     @classmethod
     def validate_ssl_mode(cls, v: Optional[str]) -> Optional[str]:
@@ -242,6 +221,27 @@ class NetbirdApiTokenPayload(BaseModel):
         return v.lower().strip()
 
 
+# ---------------------------------------------------------------------------
+# NetBird client (peer) automatic updates
+# ---------------------------------------------------------------------------
+class NetbirdClientAutoUpdatePayload(BaseModel):
+    """Push a client auto-update version/mode to one or all customers."""
+
+    version: str = Field(..., max_length=50, description="'latest', 'disabled', or a version e.g. '0.61.0'")
+    always: bool = False
+
+
+class NetbirdApiTokenPayload(BaseModel):
+    """Manually register a NetBird Personal Access Token for a customer.
+
+    Needed for customers deployed before automatic PAT capture existed —
+    create a PAT once in that customer's own NetBird dashboard
+    (Settings > Service Users / Personal Access Tokens) and paste it here.
+    """
+
+    token: str = Field(..., min_length=10, max_length=500)
+
+
 # ---------------------------------------------------------------------------
 # Users
 # ---------------------------------------------------------------------------