refactor: 代码质量优化与安全修复

- 删除根目录重复的 server.js (830行)，统一使用模块化的 server/index.js
- 修复 ESLint 错误: 移除未使用变量、修复 const 声明、处理未使用参数
- 修复 React Hooks 依赖警告: 使用 useCallback 包装函数并添加正确依赖项
- SQL LIKE 查询添加特殊字符转义，防止注入风险
- 移除 CSS 中重复的 @keyframes spin 定义

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/__tests__/validators.test.js

@@ -1,7 +1,6 @@
 const {
   isNonEmptyString,
   isValidMonth,
-  isValidDateTime,
   validateRecordPayload,
 } = require('../utils/validators');
 

server/index.js

@@ -64,7 +64,7 @@ app.get('/_next/static/:path(*)', (req, res) => {
 });
 
 app.get('*', (req, res) => {
-  let pagePath = req.path === '/' ? '/index.html' : req.path + '.html';
+  const pagePath = req.path === '/' ? '/index.html' : req.path + '.html';
   const nextPagePath = path.join(__dirname, '../frontend/.next/server/pages', pagePath);
 
   res.sendFile(nextPagePath, (err) => {

server/middleware/errorHandler.js

@@ -8,7 +8,7 @@ class AppError extends Error {
   }
 }
 
-function errorHandler(err, req, res, next) {
+function errorHandler(err, req, res, _next) {
   console.error({
     message: err.message,
     stack: err.stack,

server/routes/search.js

@@ -5,6 +5,11 @@ const { asyncHandler, AppError } = require('../middleware/errorHandler');
 
 const router = express.Router();
 
+// 转义 SQL LIKE 特殊字符
+function escapeLikePattern(str) {
+  return str.replace(/[%_\\]/g, '\\$&');
+}
+
 // 搜索账目
 router.get('/', authenticate, asyncHandler(async (req, res) => {
   const { q } = req.query;
@@ -13,14 +18,15 @@ router.get('/', authenticate, asyncHandler(async (req, res) => {
     throw new AppError('请输入搜索关键词', 400, 'MISSING_QUERY');
   }
 
+  const escapedQ = escapeLikePattern(q);
   const stmt = db.prepare(`
     SELECT * FROM records
-    WHERE user_id = ? AND (category LIKE ? OR note LIKE ?)
+    WHERE user_id = ? AND (category LIKE ? ESCAPE '\\' OR note LIKE ? ESCAPE '\\')
     ORDER BY date DESC, id DESC
     LIMIT 50
   `);
 
-  const records = stmt.all(req.userId, `%${q}%`, `%${q}%`);
+  const records = stmt.all(req.userId, `%${escapedQ}%`, `%${escapedQ}%`);
   res.json(records);
 }));